HTTP basic credentials are re-applied to the final URL after a redirect, regardless of host.

Location
python/vyos/remote.py:419, :438, :447
Problem
After following a HEAD redirect, a fresh GET to the final URL re-applies session.auth regardless of host.

Impact
Credentials disclosed to a third-party host via redirect.

Suggested fix
Only attach credentials when the final host equals the original.