--- src/url.c.url_password	2005-05-30 20:44:20.000000000 +0200
+++ src/url.c	2005-07-28 22:51:54.000000000 +0200
@@ -467,10 +467,15 @@
 {
   /* Look for '@' that comes before terminators, such as '/', '?',
      '#', or ';'.  */
-  const char *p = (const char *)strpbrk (url, "@/?#;");
-  if (!p || *p != '@')
-    return url;
-  return p + 1;
+  const char *p, *pp;
+  pp = url;
+  while ((p = (const char *)strpbrk (pp, "/?@")) != NULL) {
+    if (*p != '@')
+      break;
+    /* Found '@' character so go on with possible next '@'. */
+    pp = p + 1;
+  }
+  return pp;
 }
 
 /* Parse credentials contained in [BEG, END).  The region is expected