SourceCodester API Key Manager App 1.0 contains an import key handler that fails to properly sanitize user input. Manipulation of the import key functionality allows an attacker to inject arbitrary script that executes in the context of users viewing the affected page. The primary consequence is that an authenticated or unauthenticated user could be rendered vulnerable to script execution, potentially leading to session hijacking or defacement. The weakness corresponds to improper input validation (CWE‑79) and code injection (CWE‑94).

The vulnerability exists only in SourceCodester API Key Manager App version 1.0.

The CVSS v3 base score is 5.1, indicating moderate severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation in the near term, and the issue is not listed in the CISA KEV catalog. The attack vector is remote; an attacker only needs to send a crafted request to the import key endpoint to trigger the cross‑site scripting. No additional conditions are specified, so the flaw may be exploitable against any active user of the application.