Cpp Httplib EUVD-2026-16515

cpp-httplib versions prior to 0.39.0 with HTTP client following cross-origin redirects (301/302/307/308). Requires the application to store and use Basic Auth, Bearer Token, or Digest Auth credentials. Attacker-controlled server performs redirect to capture plaintext credentials. No victim interaction needed beyond normal HTTP client operation.

The CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N vector indicates network-exploitable attack requiring no privileges or user interaction, but with high attack complexity. The AC:H rating reflects the need for a man-in-the-middle position or control of a server the victim client connects to, limiting opportunistic exploitation. Real-world risk is elevated for applications using cpp-httplib to communicate with untrusted or semi-trusted APIs where redirect responses could be injected or manipulated. The C:H/I:H ratings are justified since credential leakage enables both information disclosure and potential account takeover. No public exploit identified at time of analysis and no CISA KEV listing reduces immediate urgency, but the straightforward nature of redirect manipulation in controlled scenarios suggests exploitation is feasible for motivated attackers with appropriate positioning. Organizations using this library in client applications connecting to external services should prioritize patching.

An attacker compromises or operates a malicious API endpoint that a cpp-httplib client application connects to with stored authentication credentials. When the client sends an authenticated request, the malicious server responds with an HTTP 302 redirect to an attacker-controlled domain. The vulnerable cpp-httplib client automatically follows the redirect while forwarding the original Authorization header containing plaintext credentials, allowing the attacker to harvest valid authentication tokens or passwords for use in account takeover or lateral movement attacks.