A cross‑session information disclosure vulnerability exists in the awesome‑llm‑apps project. The Streamlit‑based GitHub MCP Agent stores user‑supplied API tokens in process‑wide environment variables without session isolation. Consequently, a credential supplied by one user can be accessed by any subsequent unauthenticated user. This can expose GitHub Personal Access Tokens or LLM API keys, enabling unauthorized access to private resources and potential financial abuse.

The affected product is the awesome‑llm‑apps project, specifically the Streamlit‑based GitHub MCP Agent that uses Python’s os.environ to store user tokens. The vulnerability is present in the commit e46690f99c3f08be80a9877fab52acacf7ab8251, dated 2026‑01‑19. No other version range is listed in the advisory.

The CVSS score is 8.2, indicating a high‑severity issue. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the nature of the flaw makes it relatively easy to exploit: an attacker only needs access to any session of the web application to read the process’s environment variables. Tools that can inspect environment variables from the Python runtime can retrieve the tokens. Because the flaw permits data leakage without any authentication to the victim’s session, the likelihood of exploitation is significant in multi‑user deployments.