CVE-2010-1940: Apple Safari 4.0.5 on Windows sends the "Authorization: Basic" header appropriate for one web site to a dif...

Security readout for executives and security teams

This old Safari for Windows issue could leak Basic Authentication credentials to another website during a redirect. That means a server not meant to receive the credential might capture it in normal request logs. The evidence is limited and explicitly noted as third-party only. Likely limited to environments where Apple Safari 4.0.5 on Windows was used with HTTP Basic authentication. Current exposure should be treated as unlikely unless legacy browsers or archived systems remain in use. Low immediate priority for most organizations due to age and narrow affected client scope, but investigate if regulated systems used legacy Safari with Basic authentication or if historical credential exposure matters. Mitigation focus: Inventory endpoints and users for legacy Safari on Windows usage.; Retire Safari 4.0.5 on Windows where found.; Move affected users to a supported browser..

Prepared

Jun 28, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.