CVE-2026-33745

CVE-2026-33745 impacts cpp-httplib versions prior to 0.39.0, where the HTTP client improperly forwards Basic, Bearer, and Digest authentication credentials to arbitrary hosts when following cross-origin HTTP redirects. This high-severity vulnerability (CVSS 7.4) allows a malicious or compromised server to redirect a client to an attacker-controlled host, resulting in the disclosure of plaintext credentials. While the attack complexity is rated as high, the potential impact involves significant confidentiality and integrity compromise. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.