CVE-2026-3783 - Vulnerability Analysis

Overview

curl contains an OAuth2 bearer token leak caused by passing the token to redirected hostnames with .netrc credentials, letting attackers on the second hostname access the token, exploit requires HTTP(S) redirect with .netrc credentials.

Severity & Score

Impact

Attackers on the redirected hostname can obtain OAuth2 bearer tokens, leading to unauthorized access to protected resources.

Mitigation

Update to the latest curl version with the fix for token leakage.

References

• https://curl.se/docs/CVE-2026-3783.json
• https://hackerone.com/reports/3583983
• http://www.openwall.com/lists/oss-security/2026/03/11/2
• https://curl.se/docs/CVE-2026-3783.html

Social Media Activity(1 post)

daniel:// stenberg://

@bagder

Mar 11, 2026

CVE-2026-3783: token leak with redirect and netrc When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second hostname under some circumstances.

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner