AIKIDO-2026-895105

TL;DR

Azure.Core includes BearerTokenAuthenticationPolicy, which attaches a cached bearer token as the Authorization header on every per-retry send. When the pipeline follows a redirect to a different host, the policy re-attaches the original access token even though RedirectPolicy had stripped it, sending the credential to the redirect target. An attacker-controlled or otherwise unintended redirect host can therefore receive an access token issued for the original service. The fix detects when the request authority changes, defensively strips any Authorization header, and skips re-authorization and challenge handling for the redirected host.