In the affected product, a constant password is hardcoded, enabling attackers to decrypt exported provider API keys. This allows an attacker who obtains the export file to recover every third-party AI provider API key. The resulting confidentiality breach can allow abuse of those APIs, exposing user credentials and risking further exploitation.

The vulnerability affects all installations of LobsterAI released before 2026.10.16 from the netease-youdao vendor.

The CVSS score of 6.8 classifies the issue as a moderate severity data‑exposure flaw. Exploitation requires access to an exported provider key file, which can be obtained locally or transmitted to an attacker. While the EPSS score is not available, the lack of a KEV listing indicates no widespread exploitation has been observed; however, the potential to recover multiple API keys warrants caution.