# UNDF: UNDF-2026-000001193
--- a/dlls/wininet/http.c
+++ b/dlls/wininet/http.c
@@ -787,7 +787,10 @@ static void cache_basic_authorization(LPWSTR host, LPWSTR realm, LPSTR auth_data
     TRACE("caching authorization for %s:%s = %s\n",debugstr_w(host),debugstr_w(realm),debugstr_an(auth_data,auth_data_len));
+    /* DEFECT (CWE-312): auth_data is "username:password" in plain UTF-8.
+     * Logging it verbatim via TRACE exposes credentials to any process
+     * or log collector that captures Wine debug output (WINEDEBUG=+wininet).
+     * Replace with a redacted marker so host+realm are still traceable. */
-    TRACE("caching authorization for %s:%s = %s\n",debugstr_w(host),debugstr_w(realm),debugstr_an(auth_data,auth_data_len));
+    TRACE("caching authorization for %s:%s = <redacted, len=%u>\n",debugstr_w(host),debugstr_w(realm),auth_data_len);

     EnterCriticalSection(&authcache_cs);