This vulnerability causes the Session and OIDC state cookies to be sent over unencrypted connections because they lack the Secure attribute, exposing them to eavesdroppers. A single plaintext request to the origin—whether from an operator on a LAN, due to a mistyped URL, because HTTP→HTTPS is not strictly enforced, or because of a reverse proxy misconfiguration—discloses the session. The loss of confidentiality may allow an attacker to hijack a valid session and potentially access privileged data or control the operator interface. The weakness is represented by CWE-614 and is scored with a CVSS of 4.6.

The affected product is the Nebula Mesh control plane from the vendor juev. Versions earlier than 0.3.2 are impacted; the fix is included in release 0.3.2.

The CVSS score of 4.6 indicates moderate impact, while the EPSS score of less than 1% shows a very low likelihood of real‑world exploitation. It is not listed in the CISA KEV catalog. An attacker would need to send a plaintext HTTP request to the origin, which could occur on a local network, through a misconfigured reverse proxy, or due to a URL typo. Based on the description, it is inferred that no additional privileges or network segmentation are required for the exploitation.