--- lynx2.8.9rel.1.orig/WWW/Library/Implementation/HTParse.c
+++ lynx2.8.9rel.1/WWW/Library/Implementation/HTParse.c
@@ -31,6 +31,7 @@
 
 struct struct_parts {
     char *access;
+    char *auth;
     char *host;
     char *absolute;
     char *relative;
@@ -121,6 +122,18 @@
     }
 
     /*
+     * Scan left-to-right for an authentication username/password combination (auth).
+     */
+    for (p = after_access; *p; p++) {
+       if (*p == '@') {
+           parts->auth = after_access;
+           *p = '\0';
+           after_access = (p + 1); /* advance base pointer forward */
+           break;
+       }
+    }
+
+    /*
      * Scan left-to-right for a fragment (anchor).
      */
     for (p = after_access; *p; p++) {
@@ -135,10 +148,14 @@
      * Scan left-to-right for a host or absolute path.
      */
     p = after_access;
-    if (*p == '/') {
-	if (p[1] == '/') {
-	    parts->host = (p + 2);	/* host has been specified    */
-	    *p = '\0';		/* Terminate access           */
+    if (*p == '/' || parts->auth) {
+	if (p[1] == '/' || parts->auth) {
+            if (!parts->auth) {
+	         parts->host = (p + 2);	/* host has been specified    */
+	         *p = '\0';		/* Terminate access           */
+            } else {
+                parts->host = p;
+            }
 	    p = StrChr(parts->host, '/');	/* look for end of host name if any */
 	    if (p != NULL) {
 		*p = '\0';	/* Terminate host */

In reply to @hexa:lossy.network
https://www.openwall.com/lists/oss-security/2021/08/07/1

hexa: i ping you because you're good at looking at CVEs and judging whether they should be backported, etc... :)
i mean, this definitely should be merged and backported, i know that
but everyone likes having a second set of eyes, it makes things more legit

and i mean... ❤️ hexa , of course