The vulnerability resides in pkp‑lib 3.3.0 to 3.5.0 within the setData method of APIProfileForm.php. Manipulating the apiKey argument produces API keys with insufficient entropy, allowing attackers to generate or guess predictable keys and thereby gain unauthorized access to protected API resources. This flaw is identified as CWE‑330 and CWE‑331: insecure random number generation with not enough entropy.

The affected components are the pkp‑lib library versions 3.3.0, 3.4.0, and 3.5.0. Administrators operating these versions are at risk if the API key generation functionality is available to remote users.

The CVSS score of 6.3 reflects a moderate severity. The vulnerability can be triggered remotely but requires high complexity and is difficult to exploit, as the attack hinges on creating or predicting low‑entropy keys. EPSS is not reported and the issue is not listed in KEV, indicating that current exploitation rates are uncertain, yet the potential for misuse remains if an attacker can successfully guess or brute‑force a key.