The vulnerability allows an attacker to obtain exposed Firebase and Web3Forms API keys due to improper handling of sensitive credentials. With these keys, an adversary can make unauthenticated requests to backend services, potentially accessing or modifying application resources and user data. This represents a significant breach of confidentiality and integrity and is classified as a high‑severity issue (CVSS 8.2).

The issue is present in the Stalin‑143 website project before version 2.0.0, which was released in the public GitHub repository. Any deployment using a pre‑2.0.0 release is vulnerable. The affected components include Firebase services and Web3Forms integration points where API keys were inadvertently exposed.

The CVSS score of 8.2 indicates a high risk of successful exploitation. EPSS is below 1%, suggesting that active exploitation is currently rare, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector involves an attacker making direct HTTP or HTTPS requests to backend endpoints using the leaked keys, bypassing authentication, and accessing protected resources. The vulnerability is local to the web application’s configuration; an attacker only needs to obtain the keys, which are publicly exposed in the repository.