From 0bccd8d29c89d70120444088d3893af59f3772bf Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Wed, 10 Dec 2025 11:40:47 +0100
Subject: [PATCH] curl_sasl: if redirected, require permission to use bearer

Closes #19933

CVE: CVE-2025-14524
Upstream-Status: Backport [https://github.com/curl/curl/commit/1a822275d333dc6da6043497160fd04c8fa48640]

Signed-off-by: Amaury Couderc <amaury.couderc@est.tech>
---
 lib/curl_sasl.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/curl_sasl.c b/lib/curl_sasl.c
index 66639cbacc..fe646548a8 100644
--- a/lib/curl_sasl.c
+++ b/lib/curl_sasl.c
@@ -357,7 +357,9 @@ CURLcode Curl_sasl_start(struct SASL *sasl, struct Curl_easy *data,
     data->set.str[STRING_SERVICE_NAME] :
     sasl->params->service;
 #endif
-  const char *oauth_bearer = data->set.str[STRING_BEARER];
+  const char *oauth_bearer =
+    (!data->state.this_is_a_follow || data->set.allow_auth_to_other_hosts) ?
+    data->set.str[STRING_BEARER] : NULL;
   struct bufref nullmsg;
 
   Curl_conn_get_host(data, FIRSTSOCKET, &hostname, &disp_hostname, &port);
@@ -544,7 +546,9 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
     data->set.str[STRING_SERVICE_NAME] :
     sasl->params->service;
 #endif
-  const char *oauth_bearer = data->set.str[STRING_BEARER];
+  const char *oauth_bearer =
+    (!data->state.this_is_a_follow || data->set.allow_auth_to_other_hosts) ?
+    data->set.str[STRING_BEARER] : NULL;
   struct bufref serverdata;
 
   Curl_conn_get_host(data, FIRSTSOCKET, &hostname, &disp_hostname, &port);
-- 
2.43.0

