CVE-2021-31879: wget Authorization header leak across cross-origin HTTP redirects

GNU Wget through v1.21.1 leaks the Authorization header when following HTTP redirects to a different origin/host. When a server at origin A redirects to origin B (different host), wget unconditionally forwards the Authorization header to origin B without comparing hosts. This allows a malicious redirect target to harvest victim credentials.

Two vulnerable code paths exist in src/http.c:

1. --auth-no-challenge path: In maybe_send_basic_creds() (line 421-449), when opt.auth_without_challenge=true (set by --auth-no-challenge), the function sends Basic credentials to ANY host without checking if it's the original host. When gethttp() is called for the redirect target URL, initialize_request() calls maybe_send_basic_creds(new_host, global_user, global_passwd) and since opt.auth_without_challenge is true, Authorization is sent to the attacker's server.

2. --header path: In gethttp() at lines 3309-3313, user-specified headers from --header (including Authorization: Bearer ...) are unconditionally added to every HTTP request with no cross-origin check.

CVE ID: CVE-2021-31879. Fixed in wget 1.21.2.