The vulnerability lies in the Flask Secret Key Handler of OctoPrint, where a hard‑coded cryptographic key is used. A remote attacker could manipulate the function to cause the application to use this fixed key, thereby undermining the confidentiality and integrity guarantees provided by session cookies or other protected data. The key management flaw means the same key is reused universally, increasing the risk that a compromise of one instance could affect all instances sharing the key.

OctoPrint versions 1.0.0 and 1.1.0 are affected. The issue is addressed in OctoPrint version 1.11.1, which replaces the hard‑coded key with a properly generated secret key. Users running older releases should update to 1.11.1 or later.

The CVSS score of 6.9 places this at medium severity, and the EPSS score is not available. It is not listed in the CISA KEV catalog. The attack vector is remote, as the description indicates a remote manipulation of the Flask Secret Key Handler. Since the key is hard‑coded, once exploited the attacker could potentially replay or forge authenticated sessions, posing an elevated risk to privileged data.