The vulnerability allows an attacker to extract user email addresses that are exposed in base64 encoding via the state parameter present in the OAuth callback URL. This leads to exposure of personally identifiable information and is categorized as CWE‑598, representing improper handling of input that reveals confidential data.

Affected systems are instances of the Gainsight Assist plugin from Gainsight. No specific version ranges are provided in the data, so all installations that include this plugin may be affected unless an update has already been applied.

The CVSS score is 5.3, indicating moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. The likely attack vector involves an attacker manipulating the OAuth callback URL to include a crafted state parameter; the victim must use the OAuth flow for the exposure to occur. No evidence of an existing exploit is reported in the provided references.