The vulnerability stemmed from improper Authorization header handling during redirects. The commit diff shows:- The original rebuild_auth only checked hostname changes- The patch introduced should_strip_auth to check scheme/port changes- Tests were added for https->http redirect casesThe pre-patch rebuild_auth and resolve_redirects functions failed to account for scheme downgrades on same-host redirects, making them the vulnerable components. The high confidence comes from direct evidence in the patch changes and CVE description.