Reactor Netty EUVD-2026-66680

Two explicit, non-default conditions must both be satisfied for exploitation: (1) the Reactor Netty HTTP client must have been explicitly configured to follow redirects - this is an opt-in setting, not the default behavior, so applications using out-of-the-box Reactor Netty configuration are not vulnerable; and (2) a WebSocket handshake must be subject to a redirect targeting a different origin, which an attacker could achieve via a compromised intermediary, DNS manipulation, or by controlling the initial endpoint. Exploitation is further limited by the CVSS UI:R metric, indicating the client application must actively initiate the WebSocket connection. The impact is confined to credential disclosure (C:L) with no availability or confirmed integrity impact from the description.

The NVD CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) captures the network-accessible, cross-origin nature of the flaw and the scope change resulting from credential exposure to a different origin. However, AC:L overstates practical exploitation ease: the CVE description explicitly ties the vulnerability to a non-default, explicitly-enabled configuration (redirect-following on the WebSocket client), which substantially narrows the realistic attack surface compared to what AC:L implies. The I:L metric in the provided vector is also difficult to justify from the description, which describes only credential disclosure with no stated integrity impact. No EPSS data was included in the intelligence feed, no CISA KEV listing exists, and no public exploit code has been identified - all three signals point toward a measured patching priority rather than emergency remediation. The S:C scope change is well-founded: credentials leak to an attacker-controlled origin, crossing the trust boundary of the original service. Real-world exposure is gated behind an opt-in configuration, meaning the population of vulnerable deployments is a subset of all Reactor Netty users.

An attacker operates a server that responds to WebSocket upgrade requests with an HTTP redirect pointing to an attacker-controlled origin. When a Reactor Netty-based client application - configured to follow redirects - initiates a WebSocket connection to a legitimate endpoint and receives the crafted redirect response, it completes the handshake against the attacker's server while forwarding the original authentication credentials. The attacker captures those credentials for use against the legitimate service.