CVE-2026-28834 — Vulnetix

Try Vulnetix Request Demo

CVE-2026-28834 PUBLISHED CVSS 5.099999904632568 MEDIUM

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.

EPSS 0.02% · 3.9th percentile

Risk Scores

CVSS v3.1

5.099999904632568

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

0.02%

3.9th percentile

Affected Products

Vendor	Product	Versions
curl	curl	8.17.0, 7.49.1, 8.5.0
apple	macos	14.0, 15.0, 26.0
Apple	macOS	0, 0, 0

Timeline

Oct 5, 2023 PoC Published
Apr 28, 2025 PoC Published
Oct 11, 2025 PoC Published
Oct 12, 2025 PoC Published
Oct 16, 2025 PoC Published
Oct 17, 2025 PoC Published
Oct 17, 2025 PoC Published
Oct 21, 2025 PoC Published
Oct 24, 2025 PoC Published
Oct 24, 2025 PoC Published
Oct 24, 2025 PoC Published
Oct 24, 2025 PoC Published

References

https://support.apple.com/en-us/126793 advisory
https://support.apple.com/en-us/126794 advisory
https://support.apple.com/en-us/126798 advisory
https://support.apple.com/en-us/126800 advisory
https://support.apple.com/en-us/126796 advisory
https://support.apple.com/en-us/126792 advisory
https://support.apple.com/en-us/126795 advisory
https://support.apple.com/en-us/126799 advisory
https://support.apple.com/en-us/126797 advisory
https://support.apple.com/en-us/126801 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-28834 advisory
json url
www url
issue url
http://www.openwall.com/lists/oss-security/2026/01/07/4 url

Open in Interactive Console →