The vulnerability stems from an omission of required Content Security Policy directives in the keycloak component of HCL Hive Telco Observability. According to CWE‑1027, this failure can allow attackers to inject or execute arbitrary scripts in the context of the web application, potentially leading to cross‑site scripting attacks, data theft or session hijacking. The impact is primarily on confidentiality and integrity of user data and could enable lateral movement within the application if the attacker can script interactions within the user's session.

Affected product: HCL Hive Telco Observability – specifically the keycloak component. No specific version information is disclosed in the CVE report.

The CVSS score of 8.1 classifies the vulnerability as a high severity issue, indicating that exploitation could significantly disrupt the system’s security posture. EPSS data is not available, and the vulnerability is not catalogued in CISA KEV, suggesting it may not yet have widespread exploitation. The likely attack vector is through the web interface, where an attacker could craft inputs or requests that trigger the missing CSP directives and execute malicious code remotely.