Description
The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials.
Affected products
cmu: cveclient
References2
- github.com/CERTCC/cveClient/pull/39 Issue TrackingPatch
- github.com/CERTCC/cveClient/ Product
Metrics
- CVSS 3.1
-
7.5
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS — exploit probability
- 0% percentile: 15 · as of 12 November 2026
- CWE
- CWE-522
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.