Anonymous or authenticated users could steal authentication cookies because the server stores JSON Web Tokens without cryptographic protection of the payload. The vulnerability is an instance of insufficiently protected credentials, allowing an attacker to obtain a valid token and impersonate a user, thereby compromising confidentiality of user accounts and any data accessed under that session.

The affected application is toxicbishop DSA-with-tsx, a Node.js‑based educational web service. Any deployment of the application prior to commit d527fba3b3c15f185b9d1e730322dff9248391e4 is vulnerable. Versions that have not applied the patch that changed the cookie handling logic are at risk.

The vulnerability scores a CVSS of 8.1, indicating high potential impact. However, the EPSS score of less than 1% suggests a very low probability of active exploitation at the time of this analysis, and the issue is not listed in the CISA KEV catalog. An attacker would generally need to acquire the cookie through network sniffing, cross‑site scripting, or other client‑side manipulation, and then use the unprotected JWT to authenticate as a legitimate user. The exploit path is inferred from the nature of the flaw; no additional remediation is required beyond the official patch.