# Hubuum hubuum_client sensitive information leak via redirects

Source: https://junglewise.ai/threats/hubuum-hubuum-client-sensitive-information-leak-via-redirects-d0c7c1e6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 6.3 · Published 2026-07-24

The Hubuum Rust client library contains a flaw where sensitive login credentials (authentication headers) can be accidentally sent to unintended locations on the same server. If a server or an attacker can trigger a redirect, the library may follow that redirect and include the user's private security token in the new request. This could allow an unauthorized party to capture credentials if they control a different application hosted on the same domain.

Technologies: [hubuum_client (crates.io)](https://junglewise.ai/threats/technologies/hubuum-client). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 6.3, published 24 July 2026.

**Which products and versions are affected?** hubuum_client (crates.io) >= 0.0.1, < 0.6.1.

**Is there a fix for This vulnerability?** A patch was published on 2026-07-24: Fixed in version 0.6.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run hubuum_client (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Hubuum Rust client library (hubuum_client) utilizes the reqwest HTTP library with its default redirect policy. While the library's BaseUrl configuration constrains the initial request, reqwest's default behavior retains sensitive headers (like the bearer Authorization header) when a redirect occurs within the same scheme, host, and port. An attacker or a compromised server capable of influencing a 3xx redirect response can redirect a client request to a different path on the same origin, causing the client to leak the authentication token to that path. This is classified as CWE-200 (Exposure of Sensitive Information). The issue is fixed in version 0.6.1 by disabling automatic redirects in the built-in HTTP clients.

## Affected products

- Hubuum hubuum_client >= 0.0.1, < 0.6.1

## Timeline

- 2026-07-23: disclosed
- 2026-07-24: advisory
- 2026-07-24: patched: Fixed in version 0.6.1

## References

- [https://github.com/hubuum/hubuum-client-rust/security/advisories/GHSA-f45q-w629-wr25](https://github.com/hubuum/hubuum-client-rust/security/advisories/GHSA-f45q-w629-wr25)
- [https://github.com/hubuum/hubuum-client-rust/commit/5a5c275ffa45f342459b7d3e977926da643bde50](https://github.com/hubuum/hubuum-client-rust/commit/5a5c275ffa45f342459b7d3e977926da643bde50)
- [https://api.github.com/repos/hubuum/hubuum-client-rust/security-advisories/GHSA-f45q-w629-wr25](https://api.github.com/repos/hubuum/hubuum-client-rust/security-advisories/GHSA-f45q-w629-wr25)

## Related threats

- [Hubuum hubuum_client sensitive information disclosure in diagnostics](https://junglewise.ai/threats/hubuum-hubuum-client-sensitive-information-disclosure-in-diagnostics-64d85e10)
- [Hubuum hubuum_client custom transport bypass in Rust library](https://junglewise.ai/threats/hubuum-hubuum-client-custom-transport-bypass-in-rust-library-e2d3c419)