The vulnerability arises from a hard‑coded, publicly documented AES key used in AesPasswordEncAndDecServiceImpl. Because the key is static and known, any ciphertext password stored for a datasource can be decrypted by an adversary who can retrieve it. As a result, the attacker can recover the plaintext database credentials, which can be used to access or compromise the underlying database systems. This is a classic data‑exposure flaw, as the attacker can obtain sensitive authentication secrets without performing further exploitation steps.

The affected product is shaiwz:data-platform-open. Any deployment containing the commit efeacd3 includes the hard‑coded key and is therefore vulnerable. Exact version numbers are not listed in the CNA data, so any instance that has not been upgraded past this commit should be considered at risk.

The CVSS score of 7.1 indicates a moderate to high severity, while the EPSS score is unavailable and the vulnerability is not listed in CISA KEV. Access requires authentication, but an attacker can obtain the ciphertext via existing IDOR paths in the datasource detail API. Once the ciphertext is in hand, the decryption can be performed offline using the known key, allowing the attacker to recover clear‑text credentials. Overall risk is significant due to the sensitive nature of the exposed data and the ease of execution once the API is accessed.