CVE-2025-46421

What it actually does

When following HTTP redirects, the Authorization header is incorrectly forwarded to the redirect target host, exposing credentials to potentially malicious servers.

Why it matters to the business

Attackers can steal user credentials intended for trusted hosts, leading to unauthorized access and potential data breaches. With 550 days since publication, low EPSS, and no known exploitation campaigns, immediate risk is limited but affected systems should still be updated.

How an attack unfolds

An attacker crafts a redirect response from a trusted host that points to an attacker-controlled server. When the vulnerable client follows the redirect, it sends the Authorization header to the new host, enabling the attacker to impersonate the user.

How to fix it

Update radare2 to the fixed commit 44a501ba45d51776c9ea4820007477b580df50a3 or later. Apply equivalent updates to any dependent libsoup packages.

How to confirm the fix worked

Confirm the installed version contains the referenced commit. Test redirect scenarios with custom Authorization headers to verify they are not forwarded.

Typical attack path

1. Set up a server that issues an HTTP redirect to an attacker-controlled domain
2. Trigger a request from the vulnerable client to the original host
3. Intercept the Authorization header delivered to the redirect target
4. Replay captured credentials against the original service

How to detect it

Inspect network and application logs for redirect responses followed by Authorization headers sent to unexpected hosts. Correlate with client request histories to identify anomalous credential forwarding.

What your security team should do

• Apply the listed fix to all affected radare2 instances
• Audit dependencies for outdated libsoup components
• Review network logs for unexpected cross-host credential transmission