The Secure Access application can log an authentication token in clear text under certain log configuration settings. If an attacker obtains access to those logs, the token can be replayed to gain unauthorized access to an integrated system. This exposes confidential credential information and enables potential impersonation of a legitimate user.

The vulnerability affects Absolute Security Secure Access versions 12.70 through 14.19, inclusive. Systems running these releases have a logging component that may write unredacted authentication tokens to application logs.

The CVSS score of 4.6 indicates moderate severity, while the EPSS score of less than 1% shows a very low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is an attacker who gains local or remote read access to the application log files. Success requires only that log files be accessible; no additional conditions or public exploitation code are described.