The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.
{ "nvd_published_at": "2020-03-03T18:15:00Z", "github_reviewed_at": "2021-04-22T20:23:58Z", "severity": "MODERATE", "github_reviewed": true, "cwe_ids": [ "CWE-522" ] }