Lotus through 0.10.2 contains an authentication flaw that verifies API keys by checking only their prefix against stored values, ignoring the secret component. An attacker who learns or obtains a valid key prefix can send POST /api/track/ requests and register events as any organization, effectively changing metered usage and billing data. This flaw allows an unauthenticated or low‑privileged attacker to gain unauthorized access to the billing control plane, undermining confidentiality of usage data and integrity of billing.

The vulnerability affects uselotus:lotus version 0.10.2. No other versions are listed in the vendor’s affected‑version data. The product is the Lotus event ingestion middleware, accessed via HTTP APIs. The issue is present only in the 0.10.2 release and is not listed for subsequent releases.

The CVSS score of 8.2 indicates high severity, and the EPSS score is not available, so current exploit probability data is unknown. The vulnerability is not tracked in CISA’s KEV catalog. Likely attack involves remotely calling the /api/track/ endpoint after obtaining a key prefix, which may arise from leaked credentials or social engineering. Successful exploitation lets an attacker impersonate any organization, modify usage metrics, and potentially inflate or deflate charges. The impact is system‑wide for the affected organization, as it affects all usage reports and billing calculations.