CVE-2025-46421

MediumCVSS 6.8/10Last modified Jun 30, 2026

Description

A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-497

Affected software

No affected versions have been published.

Timeline

Published: Apr 24, 2025
Last modified: Jun 30, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-464227.8Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection CVE-2025-464237.8Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection CVE-2025-464244.4Dell CloudLink, versions prior to 8.2, contain use of a Cryptographic Primitive with a Risky Implementation vulnerability. A high privileged CVE-2025-464256.5Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerab CVE-2025-464278.8Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('Comma CVE-2025-464288.8Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('Comm CVE-2025-46436.3Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or inte CVE-2025-464307.3Dell Display and Peripheral Manager, versions prior to 2.1.2.12, contains an Execution with Unnecessary Privileges vulnerability in the Inst CVE-2025-464326.5In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs CVE-2025-464339.8In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible CVE-2025-464346.5Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro theplus_elementor_addon allows Exploiting Incor CVE-2025-464357.1Cross-Site Request Forgery (CSRF) vulnerability in Yash Binani Time Based Greeting time-based-greeting allows Stored XSS.This issue affects