The vulnerability is located in the CookieController.ListCookies method of Kameleo’s client‑engine‑application. By manipulating the input argument GUID, a remote attacker can trigger the disclosure of cookie data. Cookies may contain authentication tokens, session identifiers or other sensitive information, so the impact is the unauthorized exposure of secrets that could be used for session hijacking or credential theft. This flaw is classified as an information exposure and an access‑control weakness.

The flaw affects the Kameleo application, specifically the Cookie Controller component, in all releases up to and including version 5.3.1. The product is listed by the CNA as Kameleo, and the affected versions are those that include the buggy CookieController implementation.

The CVSS score of 5.3 indicates a medium severity. The EPSS score is not available, so the exact exploitation probability is unknown; however, the attack can be performed remotely without local privileges. The vulnerability is not currently listed in the CISA KEV catalog. An attacker who discovers the exposed endpoint can craft a request that supplies a manipulated GUID, causing the server to return sensitive cookie data. Because no specific exploitation chain is detailed, the risk assessment relies on the known severity and the fact that remote disclosure is possible.