urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
urllib supports redirect-following through followRedirect, which is expected behavior for an HTTP client. The issue is that, when following a redirect to a different origin, urllib preserves the caller-supplied request headers verbatim, including credential-bearing headers such as Authorization, Cookie, Proxy-Authorization, and custom auth headers (x-api-key, x-auth-token, x-access-token). If the redirect target is attacker-controlled or outside the trust boundary of the original target, credentials intended for the original origin can be …