CVE-2020-11021

CVE-2020-11021 describes a vulnerability in the NPM @actions/http-client library (versions prior to 1.0.8) where Authorization headers can be inadvertently disclosed to an incorrect domain during specific redirect scenarios. This occurs when an HTTP request with an Authorization header is redirected (302) to a different domain or hostname, causing the header to be sent to the unintended recipient. This vulnerability is rated High severity (CVSS 7.5) due to its network-based attack vector and low attack complexity, potentially leading to a complete compromise of confidentiality (C:H) if sensitive authorization tokens are exposed. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. While there is limited community discussion and media coverage, the vulnerability is not listed on the KEV catalog, suggesting it is not currently a widespread threat.