The vulnerability arises from a permissive CORS policy that reflects any origin while setting the Allow‑Credentials header to true. This configuration permits any loaded webpage to issue authenticated requests on behalf of a logged‑in user. An attacker can consequently read sensitive data such as API keys and account credentials or trigger the built‑in External Programs manager to execute code on the host machine. The flaw aligns with the CWE‑942 weakness in handling complex request headers.

The issue targets the autobrr:qui web interface used to manage qBittorrent instances. Versions 1.14.1 and all previous releases are affected. Deployments running these images in Docker containers or other environments that expose the service through a hostname other than localhost are at risk. Users operating the interface from internal networks but still reachable externally are also susceptible if no additional network restrictions are in place.

The vulnerability has a CVSS score of 9, indicating critical severity. An EPSS rating below 1 % suggests that exploit attempts are uncommon, and the vulnerability has not appeared in the KEV listing. Exploitation depends on social engineering: an attacker must persuade an authenticated user to visit an attacker‑controlled webpage. When successful, an adversary can exfiltrate credentials, capture API keys, or elevate privileges through the External Programs manager, representing a high impact if the target system is exposed. The risk remains significant for installations that are publicly reachable or have no isolation measures.