A weakness exists in the local HTTP service component of nexmoe VidBee, specifically an undisclosed function in local-api.ts. When an attacker sends a crafted request, this function may return sensitive data that should only be available to authenticated users. Because the code does not enforce proper access controls, the vulnerability exposes confidential information to anyone who can reach the service.

The affected product is nexmoe VidBee, versions up to 1.3.13 and 2.0.2 are vulnerable. The update 2.2.0, released after commit 141b8d39c1c11da4589264f814cee077df81e7f6, removes the function or protects its output. No other vendors or versions are listed.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, so the current probability of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. Attack can be launched remotely against the Local HTTP Service and the publicly available exploit can be used to obtain information without authentication.