The Awesome‑LLM‑Apps application stores user‑supplied API tokens in process‑wide environment variables using os.environ, lacking session isolation. Because the Streamlit framework serves multiple concurrent users from a single Python process, credentials supplied by one user remain accessible to subsequent, unauthenticated users, creating a vulnerability that can leak sensitive information such as GitHub Personal Access Tokens or LLM API keys. This breach of confidentiality is classified under CWE‑200, CWE‑284, and CWE‑522, potentially allowing attackers to access private resources or incur unauthorized charges.

This issue affects the Awesome‑LLM‑Apps project, specifically the release built from commit e46690f99c3f08be80a9877fab52acacf7ab8251 released on 2026‑01‑19. The product is a Streamlit‑based GitHub MCP Agent designed for use by multiple concurrent users.

The vulnerability has a high CVSS score of 8.2, but its EPSS score is below 1 %, indicating a low to moderate probability of exploitation at present. It is not listed in CISA's KEV catalog. Likely attack vectors involve remote interaction with the Streamlit web interface, where an attacker can submit a session that sets an environment variable or retrieve a token stored from a previous session. Successful exploitation would grant unauthorized access to the victim’s private repositories or LLM services.