The vulnerability arises from a VPS.org one‑click Zulip template that embeds a hardcoded application signing key, sets a default database password of 'zulip', and disables HTTPS. These misconfigurations allow an attacker who gains network access to log in as an administrator with a known password, to obtain or tamper with the signing key used to validate critical application components, and to eavesdrop on all traffic. The result is potential compromise of the entire Zulip instance, including data confidentiality, integrity, and availability.

The affected systems are any VPS.org one‑click Zulip template deployments. This includes the Zulip application installed through the template, of version, because the template contains the secrets and settings in its default configuration. There is no version specificity listed by the CNA.

The EPSS score is less than 1 % and the vulnerability is not listed in KEV, indicating a low current exploitation likelihood. The CVSS score of 9.8 indicates high severity. However, because the default password and unsecured HTTP channel are trivially known, the theoretical attack vector is simple; a remote attacker can connect to the Zulip instance, authenticate, and manipulate signed data or intercept sensitive information. The potential impact is high if an attacker succeeds, so the risk remains significant compared to the low EPSS.