Description

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c follows an offsite initial redirect, and handle_remote_auth and handle_auth pass transport->owner->url instead of transport->server.url to the credential callback when the redirected host returns 401 Unauthorized. A callback that scopes credentials to the original trusted URL can therefore return GIT_CREDENTIAL_USERPASS_PLAINTEXT credentials that libgit2 stores in transport->server.cred and sends as an Authorization header to the redirected host. An attacker who controls a trusted Git host or an open redirect on that host can disclose HTTP Basic credentials, personal access tokens, or equivalent credentials. This issue is fixed in versions 1.8.6 and 1.9.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-20T19:16:54.983Z",
  "pubdate": "2026-08-20T19:16:54.983Z",
  "executiveSummary": "libgit2 contains an authentication credential leak vulnerability in its built-in HTTP transport implementation. The flaw arises when the transport follows an offsite initial redirect and encounters a 401 Unauthorized response from the redirected host. Under these conditions, the functions handle_remote_auth and handle_auth incorrectly pass the transport->owner->url instead of the expected transport->server.url to the registered credential callback.\nThis behavior impacts applications utilizing libgit2 prior to versions 1.8.6 and 1.9.5. The risk implication is significant: if a credential callback relies on scoping credentials to the original trusted URL, it may inadvertently return GIT_CREDENTIAL_USERPASS_PLAINTEXT credentials. libgit2 then stores these sensitive secrets in transport->server.cred and transmits them within the Authorization header to the untrusted redirected host.\nAn attacker who controls a trusted Git host or leverages an open redirect vulnerability on that host possesses the capability to execute this attack. By forcing an initial offsite redirect followed by a 401 Unauthorized challenge, the attacker can intercept and disclose sensitive HTTP Basic credentials, personal access tokens, or equivalent authentication secrets.",
  "technicalDetails": "The vulnerability resides within the built-in HTTP transport located in src/libgit2/transports/http.c. Specifically, the root cause involves improper URL context handling during authentication callback invocations after an offsite redirect occurs.\nWhen a connection is established, the HTTP transport may follow an initial offsite redirect to a different destination. If the newly reached redirected host challenges the client by returning a 401 Unauthorized HTTP status code, libgit2 invokes authentication handling routines, namely handle_remote_auth and handle_auth.\nDuring this invocation, these functions fail to reference the current server URL correctly. Instead of passing transport->server.url, which represents the actual active endpoint, they pass transport->owner->url, representing the original pre-redirect URL context.\nConsequently, client-side credential callbacks designed to verify and scope credentials based strictly on the trusted original URL are misled. Trusting the provided URL context, the callback yields GIT_CREDENTIAL_USERPASS_PLAINTEXT credentials intended exclusively for the trusted origin.\nlibgit2 captures these sensitive credentials and assigns them to transport->server.cred. Subsequently, the library formats and sends these credentials via the HTTP Authorization header directly to the attacker-controlled redirected host, completing the disclosure attack flow.\nThe affected component is the HTTP transport handler within src/libgit2/transports/http.c. Affected versions include all releases of libgit2 prior to version 1.8.6 and version 1.9.5. The attack is exposed over network interfaces handling remote Git operations and requires network exposure to an attacker-controlled server or a host susceptible to open redirects."
}