BharatMLStack’s Trufflebox UI stores the JWT authentication token, the full user object and the session ID in the browser’s localStorage. Because localStorage is accessible to any JavaScript executing in the page context, an attacker who can inject or otherwise run code on the site can read these secrets. The compromised credentials allow the attacker to impersonate the user, hijack the session, or perform unauthorized actions with the user’s privileges.

BharatMLStack Trufflebox UI up to and including version 1.3.0 is affected. The vulnerability is limited to this product; no other vendors or products are listed as impacted.

Based on the description, it is inferred that the likely attack vector is a malicious script executed in the browser, such as via a reflected or stored cross‑site scripting vulnerability. The flaw is client‑side and requires a malicious script to run in the browser. The CVSS score of 5.3 indicates a medium‑severity impact, while the EPSS score of < 1% suggests a low probability of exploitation. The issue is not listed in the CISA KEV catalog, but the exposure of authentication data is concerning because any code execution on the page can read localStorage and obtain JWTs. Remediation should be treated as a priority to prevent credential theft and session hijack.