The vulnerability is a cache poisoning flaw in the SvelteKit Vercel adapter with versions prior to 6.3.2. An internal query parameter used by Incremental Static Regeneration can be accessed on any route, allowing an attacker to instruct the system to cache responses that contain user‑specific content. When a victim who is authenticated follows a malicious link, the crafted request can cause the private response to be cached and subsequently served to other users, leading to a confidentiality breach. This flaw is classified as CWE‑346, reflecting a broken object‑level authorization that permits unauthorized access to sensitive data.

The flaw affects applications built with SvelteKit that use the @sveltejs/adapter-vercel package older than version 6.3.2. Any deployment of such an app on Vercel, or similar hosting environments where the internal query parameter is exposed, is at risk until the upgrade to the fixed version is applied.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is below 1 %, meaning the probability of exploitation is low but not negligible. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires the victim to be authenticated and to click on a specially crafted link that includes the internal query parameter. Host‑level protection such as Vercel's WAF can block the request, so existing deployments are currently shielded by that mechanism, but the issue remains unresolved if the app can be accessed without that WAF protection.