The vulnerability resides in the get_conversation_history function of smart_customer_service.py in ForceInjection AI‑fundermentals. It employs a weak or broken hash algorithm, classified under CWE-327 and CWE-328, which allows an attacker to manipulate session data used during conversation history retrieval. This weakness can lead to modification or forging of conversation identifiers and potentially unauthorized data access. The description explicitly notes that remote exploitation is feasible, although it requires a high degree of complexity and is considered difficult to achieve.

ForceInjection AI‑fundermentals versions 2.0 and 3.0 are impacted. Vulnerability occurs within the Memory Recall Handler component of the smart_customer_service module. The patch identified by commit f57277fdd9ba373ace72d83c272023ec67f720d6 introduces session ownership verification in methods such as username and sessionowner.

The CVSS score of 2.3 indicates low overall severity, and the EPSS score of <1% suggests exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. While the attack is possible, the combination of low severity, high attack complexity, and low exploitation probability makes active attacks uncommon. Nonetheless, applying the patch removes the weak hash and mitigates any potential exploitation risk.