What is credential forwarding attack? Does this happen only when the client connects to two servers with same credentials?
Generally, and from what I've personally encountered in the wild / in my job, a "Credential Forwarding Attack" is form of attack that occurs when an end user attempts to connect to a legitimate service / website, but instead connects to a site owned by an attacker. The user then enters their valid credentials into the fake website, which is then both stored by the attack for future impersonation of the end user, and then "forwarded" to the real website so that the end user is able to access the website so as to not raise suspicion from the end user.
For example, say I own www.bankofammerica.com (note the typo), and I send you some phishing email asking you to review potentially unwanted purchases from your account. You click on my legitimate looking link, enter your info into my fraudulent "Bank of America" homepage and login panel, while my sites scripting forwards that info into a real BoA login in the background. Now you click "login" and I get your online banking creds, and you get forwarded to the real Bank Of America page, none the wiser.