The vulnerability arises from Streamsoft Prestiż’s use of a custom, non‑standard encoding algorithm for the KSeF (Krajowy System e‑Faktur) token. Because the encoding can be reverse‑engineered by observing tokens with known values, an attacker can predict or forge valid tokens. This effectively creates an authentication bypass that permits unauthorized access to the KSeF system. The weakness is categorized as CWE‑261, which involves improper storage or handling of secrets.

The affected product is Streamsoft Prestiż. The vendor has indicated that the issue was corrected in release 20.0.380.92. The specific versions prior to this patch are not enumerated in the advisory, so any installation leveraging the older custom encoding algorithm is presumed vulnerable. Administrators should verify the product version and apply the noted patch when possible.

The CVSS score of 6.3 signals moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely occur remotely, by collecting legitimate tokens and using the predictable encoding to generate valid authentication tokens. The requirement for initial token observation limits the attack surface, but once a token is spoofed, the attacker gains full access through that token.