AIKIDO-2026-554272

TL;DR

Negotiate authentication with empty credentials means the ambient user, whose identity lives outside libcurl. Reusing the connection for a later request still sends that request on the connection authenticated as the earlier ambient user, even when the ambient user has changed, so one user's request runs with another user's authenticated session. The fix stops that reuse for blank Negotiate credentials.