This vulnerability allows an attacker who can access the Sprig Playground to view sensitive configuration data, including the security key and credentials, and to use the hashData() signing function. The weakness is a disclosure of information that can be leveraged for credential compromise or forging signatures, meeting CWE‑200 and CWE‑489 criteria. The potential impact includes unauthorized access to protected resources, breaking of authentication flows, and possible escalation of privileges.

The Sprig plugin for Craft CMS is affected. Versions from 2.0.0 up to 2.15.1 and from 3.0.0 up to 3.15.1 are vulnerable. The issue does not affect earlier releases or later patched versions such as 2.15.2, 3.15.2 and newer.

The CVSS score of 5.5 indicates a moderate severity, but the presence of useful default access for admin users means the exploitability is non‑negligible. No EPSS score is available, and the vulnerability is not listed in the KEV catalog. The likely attack vector is through a session with admin or authorised explorer access to the Sprig Playground; an attacker can read and exploit exposed keys or run the signing function to forge data.