CVE-2025-14524: curl OAuth2 Token Disclosure Vulnerability

CVE-2025-14524 Overview

CVE-2025-14524 is an information disclosure vulnerability in cURL that affects how OAuth2 bearer tokens are handled during cross-protocol redirects. When an HTTP(S) transfer using OAuth2 bearer token authentication is redirected to a URL using a different protocol scheme (IMAP, LDAP, POP3, or SMTP), cURL may incorrectly pass the bearer token to the new target host. This behavior could allow an attacker to capture sensitive authentication credentials by exploiting redirect mechanisms.

Critical Impact

OAuth2 bearer tokens may be inadvertently leaked to unauthorized hosts when cURL follows cross-protocol redirects, potentially enabling credential theft and unauthorized access to protected resources.

Affected Products

• cURL (specific affected versions to be confirmed via vendor advisory)
• libcurl implementations
• Applications and services utilizing cURL for HTTP transfers with OAuth2 authentication

Discovery Timeline

• 2026-01-07 - Vulnerability disclosed via Openwall OSS-Security Discussion
• 2026-01-08 - CVE CVE-2025-14524 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-14524

Vulnerability Analysis

This vulnerability represents an improper credential handling flaw in cURL's redirect processing logic. The core issue stems from insufficient validation when cURL encounters a cross-protocol redirect during an authenticated HTTP(S) session. OAuth2 bearer tokens, which are designed specifically for HTTP-based authentication, should not be transmitted over non-HTTP protocols such as IMAP, LDAP, POP3, or SMTP.

When a redirect occurs from an HTTPS endpoint to a URL using one of these alternative protocol schemes, cURL fails to properly sanitize the authentication context. This results in the bearer token being passed along with the redirect request to the new protocol handler, potentially exposing the token to unintended recipients or logging systems.

Root Cause

The root cause lies in cURL's redirect handling mechanism, which does not adequately distinguish between protocol-appropriate and protocol-inappropriate authentication credentials. The OAuth2 bearer token authentication context is maintained across redirects without validating whether the target protocol supports or should receive such credentials. This represents a failure in the principle of least privilege for credential transmission.

Attack Vector

An attacker could exploit this vulnerability by:

1. Setting up a malicious server that responds to HTTP(S) requests with a redirect to an attacker-controlled IMAP, LDAP, POP3, or SMTP server
2. Tricking a victim application using cURL with OAuth2 authentication into making a request to the initial HTTP(S) endpoint
3. When cURL follows the cross-protocol redirect, the bearer token is transmitted to the attacker's server
4. The attacker captures the OAuth2 bearer token and can use it to impersonate the victim

The attack requires the ability to influence redirect responses from servers that the victim application trusts, or to perform man-in-the-middle attacks on unencrypted connections. Applications that automatically follow redirects without protocol validation are particularly susceptible.

Detection Methods for CVE-2025-14524

Indicators of Compromise

• Unexpected IMAP, LDAP, POP3, or SMTP connections originating from systems that typically only perform HTTP(S) transfers
• OAuth2 bearer tokens appearing in non-HTTP protocol traffic logs
• Authentication failures following legitimate HTTP requests that were unexpectedly redirected
• Suspicious redirect responses in web server or proxy logs directing traffic to non-HTTP protocols

Detection Strategies

• Monitor network traffic for cross-protocol redirects, particularly HTTP(S) to IMAP, LDAP, POP3, or SMTP
• Implement logging for cURL operations to track redirect chains and protocol transitions
• Review application logs for unexpected authentication token transmission patterns
• Deploy network-based detection rules to identify bearer tokens in non-HTTP protocol traffic

Monitoring Recommendations

• Enable verbose logging in applications using libcurl to capture redirect behavior
• Implement security information and event management (SIEM) rules to detect cross-protocol redirect patterns
• Monitor for anomalous outbound connections to mail (IMAP, POP3, SMTP) and directory (LDAP) services from web application servers

How to Mitigate CVE-2025-14524

Immediate Actions Required

• Review the cURL CVE-2025-14524 Advisory for specific patch information and affected versions
• Update cURL and libcurl to the latest patched version when available
• Audit applications using cURL with OAuth2 authentication for redirect handling configurations
• Consider disabling automatic redirect following in sensitive authentication contexts

Patch Information

The cURL project has published a security advisory addressing this vulnerability. Administrators should consult the cURL CVE-2025-14524 Advisory for specific version information and patch downloads. The HackerOne Report #3459417 contains additional technical details about the vulnerability discovery.

Workarounds

• Configure cURL to disable automatic redirect following using CURLOPT_FOLLOWLOCATION set to 0 or the -L flag removed from command-line usage
• Implement application-level validation of redirect destinations before following them
• Restrict allowed protocols using CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS to prevent cross-protocol redirects
• Use network-level controls to block unexpected outbound IMAP, LDAP, POP3, and SMTP connections from web application servers

# Configuration example - Restrict redirect protocols in cURL
# Use --proto-redir to limit which protocols cURL will redirect to
curl --proto-redir '=https,http' --oauth2-bearer "token" https://example.com/api

# In libcurl applications, set CURLOPT_REDIR_PROTOCOLS to restrict redirect protocols
# CURLOPT_REDIR_PROTOCOLS = CURLPROTO_HTTP | CURLPROTO_HTTPS