The vulnerability allows an attacker to create a new API key from an existing access token in Octopus Server, with the new key inheriting a lifetime that exceeds that of the original token. This effectively extends an authenticated session’s validity beyond its intended duration, enabling an attacker to perform unauthorized actions for a longer period. The weakness is a classic example of improper privilege escalation due to inadequate access control, classified as CWE‑863.

Octopus Deploy’s Octopus Server product is affected; no specific product versions are listed, so all currently running installations require verification.

The CVSS score of 2.3 indicates low severity, and the EPSS score of less than 1% suggests exploitation is unlikely in the wild. However, the attack vector is inferred to be user‑initiated; any individual or process that possesses a valid access token can exploit the flaw to generate a longer‑lived key. The vulnerability is not listed in the CISA KEV catalog, which further lowers the immediacy of risk. Nevertheless, once a key with an extended lifetime is created, the attacker gains prolonged access to the system’s APIs, which can lead to privilege escalation and potential data exposure.