The vulnerability allows an attacker to retrieve the QKEY used for the ‘OTA-Quantum’ device registration process, as well as other internal system keys, by issuing a simple HTTP GET request. The exposed keys are transmitted over an unencrypted channel and do not require any authentication. This flaw is a classic example of weak access control (CWE‑749) and can lead to compromise of cryptographic material, undermining the security of the entire key agreement process.

Arqit Symmetric Key Agreement Platform, all releases prior to version 26.03.

The CVSS score of 8.7 indicates a high severity. Although an EPSS score is not available, the lack of authentication and encryption means any actor with network reach to the platform can exploit the flaw immediately, making exploitability likely. The vulnerability is not listed in the CISA KEV catalog, but its potential to compromise key material warrants urgent attention. Attackers would simply send an unauthenticated HTTP GET request to the vulnerable endpoint, read the plaintext key data, and then use those keys to impersonate devices or decrypt protected communications.