The vulnerability resides in MinIO’s embedded console component, specifically the SessionTokenAuthenticate routine in cmd/common-main.go. A hard‑coded cryptographic key is used to authenticate session tokens, violating key management best practices (CWE‑320 and CWE‑321). This flaw lets an attacker generate or tamper with session tokens and gain authorized console access without valid credentials. The consequence is remote unauthorized control over the MinIO instance, potentially exposing data or granting privileged operations.

The affected vendor is MinIO. The product is the MinIO Embedded Console. Versions up to RELEASE.2025‑10‑15T17‑29‑55Z are vulnerable. These releases are no longer supported, meaning no vendor‑issued patch exists for the flaw. Only deployments running these specific releases are impacted.

With a CVSS base score of 6.9 the vulnerability falls into the Medium severity range. The EPSS score is not available, and it is not listed in the CISA KEV catalog, but the vulnerability has been publicly disclosed and can be exploited remotely. Attackers need only to craft a session token using the hard‑coded key, a straightforward operation once the formula is known. Organizations should treat the risk as moderate to high, especially if the console remains exposed to untrusted networks.