A flaw in the foreUP customer REST API lets an authenticated user read cleartext payment‑processor merchant credentials sent back in the response body. The exposed merchant IDs and secrets enable an attacker to impersonate the merchant, initiate unauthorized transactions, or otherwise compromise the payment infrastructure. The weakness is an information exposure vulnerability that reveals sensitive data to an unauthorized actor.

All releases of foreUP that expose the customer REST API endpoint are potentially affected. No specific version information is supplied, so every current deployment that implements the API should be considered vulnerable until a patch removes the credential disclosure.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The flaw does not appear in the CISA KEV catalog, indicating no known public exploitation yet. Because an attacker only needs to possess valid authenticated credentials, the vulnerability can be trivially exercised by re‑using stolen credentials or by gaining access through a separate authentication bypass. The primary risk is a confidentiality breach of merchant payment credentials.