This vulnerability occurs when API keys used by the temporary browser client are stored in IndexedDB without any protection, making them extractable through the browser’s JavaScript console or other error conditions. Because the encryption credentials can be read by anyone who can execute JavaScript in that context, an attacker can obtain the keys used for authenticating API calls, leading to credential compromise and potential unauthorized access to secure services.

The affected component is the CERT/CC cveClient, specifically the encrypt-storage.js module that handles credential storage. No explicit version information is provided in the advisory, so all releases that deploy this module unchanged may be affected. Users of the client should verify whether their installation includes the unprotected storage behavior.

The CVSS score of 7.5 indicates a high impact, and the EPSS score below 1% suggests rare exploitation in the wild. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires the attacker to run arbitrary JavaScript in the victim’s browser typically via a malicious script injected into a trusted page or by exploiting an existing web vulnerability, after which the attacker can read the unprotected credentials from IndexedDB.