CVE-2026-63481 affects Hurl versions prior to 8.0.1. The vulnerability is a credential-scoping bypass: when Hurl follows a redirect to a different host, it correctly strips Authorization headers and raw Cookie headers, but cookies defined in the [Cookies] section are NOT stripped. An attacker who controls a redirect destination receives cookies—session tokens, API keys, or other sensitive credentials—that users never expected to leave the original domain.
This is not a blanket failure to implement cookie scoping. It's a selective exception: one credential source bypasses protection applied uniformly to every other type. The [Cookies] section was implemented as a separate code path from header handling, and when developers added host-scoping logic to the redirect handler, they saw 'Authorization headers' and 'Cookie headers' but not the structured cookie store sitting above them. The convenience abstraction that makes the [Cookies] section easy to use also made it cognitively invisible as a credential injection vector.
Upgrade to Hurl 8.0.1. Beyond that, audit your HTTP testing toolchain: check whether curl, httpie, or similar tools apply the same cross-host redirect restrictions to structured credential stores (like --cookie-jar, config-based auth, or bearer-token shortcuts) as they do to raw headers. The fix here was a single missing strip operation, which suggests this is a class of oversight rather than intentional design—meaning other tools almost certainly carry similar gaps. The low EPSS score (0.00473) understates the risk because Hurl's user base skews toward security-sensitive workflows where authenticated testing against production-adjacent systems is routine, and cross-host redirects in staging, CI, and webhook integrations are common rather than exotic.