Based on the description, it is inferred that the vulnerability arises from storing a combined private key and certificate PEM locally without owner‑only file system permissions. The vulnerability originates from the @quasar/ssl-certificate utility, which stores this combined PEM without explicit permission setting. Another local user able to read the cache file can copy the private key and certificate, effectively impersonating the development TLS endpoint in an environment that trusts the generated certificate. Additionally, the certificate is CA‑capable and includes overly broad key usages and an IPv6 loopback address as a SAN, further magnifying potential misuse. The flaw is a classic example of incorrect permission assignment (CWE‑732) that permits unauthorized disclosure of sensitive cryptographic material.

Affected products are the Quasar Framework utilities: @quasar/ssl-certificate prior to 2.1.0, @quasar/cli before 5.0.4, and @quasar/app‑vite before 3.3.0. All installations that rely on these components for generating TLS certificates during development are at risk.

The CVSS base score of 8.4 indicates high severity, and while no EPSS value is available, the lack of exploitation data does not diminish its risk; an attacker who can log onto the same host and read writable files may gain the cached key and certificate immediately. Because the vulnerability does not require network access and is confined to local users, its exploitability is limited to environments where an attacker can run code locally. The absence from the KEV catalog means no known public exploitation, but the flaw’s nature suggests it could be used for insider attacks or by compromised local accounts to compromise development environments.