@@ -109,6 +109,20 @@ func fromChallenge(reg name.Registry, auth authn.Authenticator, t http.RoundTrip
 	}, nil
 }
 
+// realmRedirectCheck mimics the default http.Client redirect policy but also
+// validates each redirect URL with validateRealmURL.
+func realmRedirectCheck(insecure bool) func(*http.Request, []*http.Request) error {
+	return func(req *http.Request, via []*http.Request) error {
+		if len(via) >= 10 {
+			return fmt.Errorf("stopped after 10 redirects")
+		}
+		if err := validateRealmURL(req.URL.String(), insecure); err != nil {
+			return fmt.Errorf("refusing token-server redirect to %q: %w", req.URL, err)
+		}
+		return nil
+	}
+}
+
 // validateRealmURL returns an error if the realm URL uses a disallowed scheme
 // or resolves to a private / link-local IP address. This prevents a crafted
 // WWW-Authenticate header from redirecting token fetches to internal services.
@@ -378,7 +392,8 @@ func (bt *bearerTransport) refreshOauth(ctx context.Context) ([]byte, error) {
 		v.Set("access_type", "offline")
 	}
 
-	client := http.Client{Transport: bt.inner}
+	allowInsecure := bt.scheme == "http"
+	client := http.Client{Transport: bt.inner, CheckRedirect: realmRedirectCheck(allowInsecure)}
 	req, err := http.NewRequest(http.MethodPost, u.String(), strings.NewReader(v.Encode()))
 	if err != nil {
 		return nil, err
@@ -415,7 +430,8 @@ func (bt *bearerTransport) refreshBasic(ctx context.Context) ([]byte, error) {
 		auth:   bt.basic,
 		target: u.Host,
 	}
-	client := http.Client{Transport: b}
+	allowInsecure := bt.scheme == "http"
+	client := http.Client{Transport: b, CheckRedirect: realmRedirectCheck(allowInsecure)}
 
 	v := u.Query()
 	bt.mx.RLock()
 
@@ -560,6 +560,42 @@ func TestInsufficientScope(t *testing.T) {
 	}
 }
 
+// TestTokenServerRedirectSSRF verifies that a malicious token server cannot
+// redirect token-fetch requests to private/loopback addresses, bypassing the
+// initial validateRealmURL check.
+func TestTokenServerRedirectSSRF(t *testing.T) {
+	// internalServer simulates an internal service that should never be reached.
+	internalServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		fmt.Fprintf(w, `{"token": "should-not-reach-this"}`)
+	}))
+	defer internalServer.Close()
+
+	// tokenServer issues a redirect to the internalServer on every request.
+	tokenServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, internalServer.URL+"/token", http.StatusFound)
+	}))
+	defer tokenServer.Close()
+
+	registry, err := name.NewRegistry("registry.example.com", name.WeakValidation)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	bt := &bearerTransport{
+		inner:    http.DefaultTransport,
+		basic:    &authn.Basic{Username: "foo", Password: "bar"},
+		registry: registry,
+		realm:    tokenServer.URL + "/token",
+		scopes:   []string{"repo:example/image:pull"},
+		service:  "registry.example.com",
+		scheme:   "http",
+	}
+
+	if err := bt.refresh(context.Background()); err == nil {
+		t.Error("refresh() should have been rejected when token server redirects to loopback address")
+	}
+}
+
 func TestValidateRealmURLUnspecified(t *testing.T) {
 	// 0.0.0.0 and :: resolve to localhost on most OSes.
 	// They should be blocked like other private addresses.