GHSA-8mxv-9xhp-86h4: rclone: S3 Redirect Sanitization Omits IBM IAM Bearer Tokens and SSE-C Keys

The S3 redirect callback strips X-Amz-Security-Token when a redirect changes scheme or host, but it does not strip IBM IAM bearer authorization or customer-provided encryption keys. Two independently validated paths remain:

• a same-host HTTPS-to-HTTP redirect preserves Authorization: Bearer ... and exposes a reusable IBM IAM token to the plaintext network path;
• a cross-origin redirect preserves SSE-C and copy-source SSE-C key headers.

The High rating is driven by the reusable IBM IAM bearer token. The SSE-C cross-origin disclosure is a secondary confidentiality issue. The meaningful threat is a trusted endpoint, gateway, or accelerator that emits an unsafe redirect, followed by an adjacent/on-path observer; describing the originally configured endpoint itself as the attacker would be weak because that endpoint already receives the request secrets.