This CORS misconfiguration allows an unauthenticated attacker to use a malicious cross‑origin web page to retrieve the session token of any authenticated user and hijack the account with Administrator privileges. The flaw exploits an erroneous Access‑Control‑Allow‑Credentials header in the REST API, identified as CWE‑942. Consequently, the attacker can gain unrestricted control of the platform, violating confidentiality, integrity, and availability of the system.

Network Optix Nx Witness VMS running the default Standard security mode on Linux or Windows is affected in all releases prior to version 6.1.2. The High security mode is not impacted, nor are versions 6.1.2 and later because the configuration defaults to disabling credential sharing.

With a CVSS v3 score of 7.5 the vulnerability is considered high severity, and although EPSS data is not available, the lack of a KEV listing does not reduce its potential exploitability. The attack can be carried out remotely by simply hosting a malicious web page that the victim visits; no authentication is required to extract the session token, making exploitation straightforward for attackers with social‑engineering or phishing capabilities.