CVE-2025-14524

MediumCVSS 5.3/10Last modified Sep 15, 2026

Description

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522 CWE-601

Affected software

Vendor	Product	Versions
curl	curl	>= 7.33.0, < 8.14.2; >= 8.15.0, < 8.16.1; >= 8.17.0, < 8.18.0
curl	curl	>= 06c1bea72faabb6fad4b7ef818aafaa336c9a7aa, < 1a822275d333dc6da6043497160fd04c8fa48640
curl	curl	8.17.0; 8.16.0; 8.15.0; 8.14.1; 8.14.0; 8.13.0; 8.12.1; 8.12.0; 8.11.1; 8.11.0; 8.10.1; 8.10.0; 8.9.1; 8.9.0; 8.8.0; 8.7.1; 8.7.0; 8.6.0; 8.5.0; 8.4.0

References

https://curl.se/docs/CVE-2025-14524.htmlPatch, Vendor Advisory
https://curl.se/docs/CVE-2025-14524.jsonVendor Advisory
https://hackerone.com/reports/3459417Exploit, Issue Tracking, Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/01/07/4Mailing List, Patch, Third Party Advisory

Timeline

Published: Jan 8, 2026
Last modified: Sep 15, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-145256.4A flaw was found in kubevirt. A user within a virtual machine (VM), if the guest agent is active, can exploit this by causing the agent to r CVE-2025-145268.8A security flaw has been discovered in Tenda CH22 1.0.0.1. This affects the function frmL7ImForm of the file /goform/L7Im. Performing a mani CVE-2025-145279.8A weakness has been identified in projectworlds Advanced Library Management System 1.0. This vulnerability affects unknown code of the file CVE-2025-145287.5A vulnerability was detected in D-Link DIR-803 up to 1.04. Impacted is an unknown function of the file /getcfg.php of the component Configur CVE-2025-145299.8A flaw has been found in Campcodes Retro Basketball Shoes Online Store 1.0. The affected element is an unknown function of the file /admin/a CVE-2025-14534.8The Category Posts Widget WordPress plugin before 4.9.20 does not sanitise and escape some of its settings, which could allow high privilege CVE-2025-145307.2A vulnerability has been found in SourceCodester Real Estate Property Listing App 1.0. The impacted element is an unknown function of the fi CVE-2025-145314.3A vulnerability was found in code-projects Rental Management System 2.0. This affects an unknown function of the file Transaction.java of th CVE-2025-145329.8DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction CVE-2025-145339.8The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.9.2.CVE-2025-145349.8A vulnerability was determined in UTT 进取 512W up to 3.1.7.7-171114. This impacts the function strcpy of the file /goform/formNatStaticMap of CVE-2025-145359.8A vulnerability was identified in UTT 进取 512W up to 3.1.7.7-171114. Affected is the function strcpy of the file /goform/formConfigFastDirect