CVE-2026-20664 — Vulnetix

Try Vulnetix Request Demo

CVE-2026-20664 PUBLISHED CVSS 5.300000190734863 MEDIUM

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.

EPSS 0.02% · 4.3th percentile

Risk Scores

CVSS v3.1

5.300000190734863

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS Score

0.02%

4.3th percentile

Affected Products

Vendor	Product	Versions
apple	ipados	0
apple	iphone_os	0
Apple	iOS and iPadOS	0
Apple	visionOS	0
curl	curl	7.33.0, 7.37.1, 7.37.0
apple	macos	26.0
Apple	macOS	0
Apple	Safari	0
apple	visionos	0
apple	safari	0

Timeline

Oct 5, 2023 PoC Published
Apr 28, 2025 PoC Published
Oct 11, 2025 PoC Published
Oct 12, 2025 PoC Published
Oct 16, 2025 PoC Published
Oct 17, 2025 PoC Published
Oct 17, 2025 PoC Published
Oct 21, 2025 PoC Published
Oct 24, 2025 PoC Published
Oct 24, 2025 PoC Published
Oct 24, 2025 PoC Published
Oct 24, 2025 PoC Published

References

https://support.apple.com/en-us/126799 url
https://support.apple.com/en-us/126800 url
https://support.apple.com/en-us/126793 advisory
https://support.apple.com/en-us/126794 advisory
https://support.apple.com/en-us/126798 advisory
https://support.apple.com/en-us/126796 advisory
https://support.apple.com/en-us/126792 advisory
https://support.apple.com/en-us/126795 advisory
https://support.apple.com/en-us/126797 advisory
https://support.apple.com/en-us/126801 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-20664 advisory
json url
www url
issue url
http://www.openwall.com/lists/oss-security/2026/01/07/4 url

Open in Interactive Console →