CVE-2026-86413: Negotiate credentials sent to redirected origin

I found a way to make libcurl send a live SPNEGO/Kerberos `Authorization: Negotiate` token to a host the client never intended to authenticate to, bypassing the cross-host auth restriction, when following a redirect whose `Location:` header embeds userinfo (`http://user:[email protected]/...`).

// lib/http.c:874
if(data->state.creds || Curl_auth_allowed_to_host(data))
    result = output_auth_headers(data, conn, authhost, request,
                                 path_and_query, FALSE);