AIKIDO-2026-598331

TL;DR

When a SOCKS proxy is configured with proxy authentication, the client does not check the proxy type, so it attaches the SOCKS proxy's Proxy-Authorization header, or answers a 407 challenge, on a connection that reaches the origin server through the SOCKS tunnel rather than the proxy. The origin server, and anyone on the origin side of the wire, receives the proxy's own credentials, which are directly reversible for Basic and can be replayed or cracked offline for NTLM, Kerberos, and SPNEGO. This is reachable with preemptive proxy authentication and, by default, whenever a hostile origin answers with 407. The fix attaches proxy credentials only to a request the proxy itself receives and stops answering a 407 on a non-HTTP proxy connection with the proxy's credentials.