HTTP client: requests can reuse a connection authenticated for another origin

When ambient user credentials are in use, an HTTP request aimed at one origin can be sent over a connection already authenticated via Negotiate for a different origin. The request then goes out without the credentials it was meant to carry, and the sources do not say which library or product is affected.

Summary written from the sources below. Check the originals before acting.