The flaw is a log injection vulnerability that enables an authenticated local user to view sensitive data recorded by the SCIM Driver module. While processing authentication and user provisioning requests, the driver writes personally identifiable information, authentication tokens, or other protected data directly into log files, creating a straightforward path for confidentiality compromise.

Vulnerable versions of the OpenText IDM Driver and Extensions are 1.0.0.0000 through 1.0.1.0300 and 1.1.0.0000 on Windows and 64‑bit Linux platforms.

With a CVSS score of 7.3 the vulnerability is considered high severity. EPSS data is not available, and the defect is not listed in the CISA KEV catalog, yet it requires only local authenticated access, which is commonly available to users with log‑read or administrative privileges. An attacker who exploits this flaw could retrieve credentials, personal identifiers, or other sensitive information exposed in the logs.