Executive brief
libgit2 is a Git library used by applications to interact with Git repositories. When an HTTP request is redirected to a different host, the library incorrectly passes credentials intended for the original host to the redirected destination. An attacker controlling a trusted Git host or an open redirect can intercept HTTP Basic credentials, personal access tokens, or similar secrets.
Technical details
The vulnerability is a credential disclosure flaw in libgit2's HTTP transport layer (src/libgit2/transports/http.c). When the built-in HTTP transport follows an HTTP redirect and the redirected server responds with 401 Unauthorized, the authentication handler passes the original URL (transport->owner->url) instead of the current/redirected server URL (transport->server.url) to the credential callback. This causes callbacks that scope credentials to a trusted origin to return plaintext credentials that are then sent via Authorization headers to the untrusted redirected host. The attack requires an attacker to control or influence the redirect target. Fixed in versions 1.8.6 and 1.9.5.
Affected products
- libgit2 libgit2 before 1.8.6 and before 1.9.5
Timeline
- 2026-08-20: disclosed