OpenSift’s local JSON persistence was designed without atomic operations or adequate synchronization, creating a race condition that can cause concurrent read/write operations to overwrite or lose data. The result is loss or corruption of user state across study, quiz, flashcard, wellness, or authentication stores, potentially erasing progress or changing quiz outcomes. The weakness aligns with CWE‑362 (Concurrent Execution with Shared Resource) and CWE‑367 (Deadlock or Resource Starvation).

The vulnerability affects the OpenSift AI study tool, specifically versions 1.1.2‑alpha and earlier. Updated builds beginning with 1.1.3‑alpha contain the fix and are not affected.

The CVSS score of 6.6 indicates a moderate severity, with an EPSS score below 1% suggesting a low probability of exploitation. The issue is not listed in the CISA KEV catalog. The likely attack scenario is local or co‑located users performing parallel operations that trigger the race condition; non‑remote exploitation. No public exploit is documented. The impact is limited to data integrity rather than remote code execution or privilege escalation.