diff --git a/lib/filelib.php b/lib/filelib.php
index dea73420e62..2ea907de9f8 100644
--- a/lib/filelib.php
+++ b/lib/filelib.php
@@ -3906,9 +3906,22 @@ class curl {
 
                 curl_setopt($curl, CURLOPT_URL, $redirecturl);
 
-                if (parse_url($currenturl)['host'] !== parse_url($redirecturl)['host']) {
+                // If CURLOPT_UNRESTRICTED_AUTH is empty/false, don't send credentials to other hosts.
+                // Ref: https://curl.se/libcurl/c/CURLOPT_UNRESTRICTED_AUTH.html.
+                $isdifferenthost = parse_url($currenturl)['host'] !== parse_url($redirecturl)['host'];
+                $sendauthentication = !empty($this->options['CURLOPT_UNRESTRICTED_AUTH']);
+                if ($isdifferenthost && !$sendauthentication) {
                     curl_setopt($curl, CURLOPT_HTTPAUTH, null);
                     curl_setopt($curl, CURLOPT_USERPWD, null);
+                    // Check whether the CURLOPT_HTTPHEADER is specified.
+                    if (!empty($this->options['CURLOPT_HTTPHEADER'])) {
+                        // Remove the "Authorization:" header, if any.
+                        $headerredirect = array_filter(
+                            $this->options['CURLOPT_HTTPHEADER'],
+                            fn($header) => strpos($header, 'Authorization:') === false
+                        );
+                        curl_setopt($curl, CURLOPT_HTTPHEADER, $headerredirect);
+                    }
                 }
 
                 $ret = curl_exec($curl);