Authorization header leak in rubygem Mechanize

The Mechanize web automation library leaks the Authorization header (which contains sensitive credentials) when a website redirects you to a different port on the same domain. This means your login credentials could be exposed to an attacker who controls that alternate port.

CWE-200 information disclosure vulnerability in Mechanize versions before 2.8.5: the library fails to clear the Authorization header during cross-port redirects on the same host, allowing credentials to be transmitted to an unintended endpoint. Attack vector requires the application to follow a malicious redirect response; impact is credential exposure if the attacker controls the alternate port.