CVE-2026-5545: wrong reuse of HTTP Negotiate connection

Summary:

An attacker sharing a libcurl multi-handle connection pool can hijack another user's Negotiate/Kerberos-authenticated connection. When User A authenticates via Negotiate (SPNEGO) and the connection returns to the pool, User B using CURLAUTH_ANY with different credentials gets that connection attached to their transfer. On servers with persistent Negotiate auth (Windows IIS with Kerberos — the default), User B's requests execute as User A.

The root cause is in url_match_auth_ntlm() (lib/url.c:1092): a tentative match sets m->found for a connection with mismatched credentials, returns FALSE, which exits the matching chain before url_match_auth_nego() can reject the connection. url_match_result() then attaches the connection based solely on m->found being non-NULL, ignoring the FALSE result.

Affected version

• curl 8.20.0-DEV (master, commit 2b3dfb4, 2026-03-31)
• Built with --enable-debug --with-openssl --with-gssapi
• Both USE_NTLM and USE_SPNEGO compiled in (verified via curl_setup.h)
• Test uses curl's built-in CURL_GSS_STUB (debug-build fake GSSAPI)