The vulnerability is caused by hardcoded third‑party authorization data embedded in JavaScript on the Foxit official website. Because the credentials are publicly accessible, an attacker can retrieve them and misuse them to access services that rely on the exposed tokens. This is a classic example of the CWE‑798 weakness. The disclosed information can lead to unauthorized access or privilege escalation if the credentials are utilized against the victim's infrastructure or services.

Foxit Software Inc. exposes the flaw through its main website, foxit.com. No specific software version or component is listed, and the issue is confined to the frontend code delivered to visitors of the website.

The CVSS score of 8.6 indicates a high severity due to the availability of the information to all web users. The EPSS score is not available, but the vulnerability is trivially exploitable by anyone who visits the site and views the source code. Because no special authentication is required, the risk to users is high, and the situation is listed as not in the CISA KEV catalog, meaning no active exploitation reports are currently known.