GHSA-f45q-w629-wr25: Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects

The built-in async and blocking clients used reqwest’s default redirect policy. BaseUrl constrains the initial request to the configured origin and path prefix, but redirect processing occurs after that validation. reqwest retains sensitive headers when a redirect changes only the path on the same scheme, host, and port. A redirect from a Hubuum endpoint to another path on a shared origin could therefore carry the bearer Authorization header outside the configured Hubuum path prefix.

Exploitation requires an attacker, compromised server, or intermediary to influence a 3xx response. Cross-origin redirects are not affected because reqwest strips sensitive headers when scheme, host, or port changes.