The vulnerability allows an attacker to hijack active sessions and messages in the NATS-Server by crafting a malicious MQTT Client ID. This weakness can be exploited to gain unauthorized control over communication flows, potentially leading to data interception or tampering with the messaging system.

The flaw affects the nats-server by nats-io. Versions earlier than 2.11.15 and 2.12.5 are vulnerable. The issue is fixed starting with 2.11.15 and 2.12.5 and any later releases.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is less than 1%, suggesting low exploitation probability, and the vulnerability is not present in the CISA KEV catalog. Based on the description, the likely attack vector involves a malicious MQTT client connecting to the server with a crafted Client ID, allowing the attacker to hijack existing sessions or manipulate messages.