The flaw stems from storing user passwords in plaintext within BLUVOYIX and exposing them through an unauthenticated API. An attacker can send crafted HTTP requests to the users API endpoint to retrieve the plaintext credentials for every account. With these credentials, the attacker can log into the platform using an exposed administrative email and password, granting complete control over customer data and potentially enabling further compromise of the system.

The vulnerability affects all releases of BLUVOYIX from Bluspark Global. No specific version constraints were provided, so any currently deployed instance is potentially vulnerable.

The CVSS score of 10 classifies this as a critical vulnerability, while the EPSS score indicates a very low but non‑zero likelihood of exploitation. Because the API is unauthenticated, an attacker does not need any privileges to exploit it. The impact is full platform compromise and credential theft. The vulnerability is not listed in the CISA KEV catalog.