CVE-2020-5404

CVE-2020-5404 describes a credentials leak vulnerability in Reactor Netty's HttpClient, affecting versions 0.9.x prior to 0.9.5 and 0.8.x prior to 0.8.16. This flaw occurs when the HttpClient is explicitly configured to follow redirects, potentially exposing credentials if a redirect leads to a different domain. Rated Medium with a CVSS score of 5.9, exploitation requires high attack complexity and low privileges, resulting in high confidentiality impact. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this vulnerability.