The vulnerability is located in the open‑source OneBlog platform, version 2.3.9, within RestApiController.java, JsApiTicketComponent.java, and GetAccessTokenComponent.java. It results from a lack of proper authentication or authorization, allowing any remote user to request tokens or configuration data that should be protected. This flaw is categorized as CWE‑306, an Information Disclosure without Authentication weakness. The result is that a remote attacker can retrieve sensitive information such as access tokens and settings. No code execution or denial of service is indicated; the attack is purely informational.

The affected product is the OneBlog open‑source blogging system, version 2.3.9. The vulnerability affects the core API components RestApiController, JsApiTicketComponent, and GetAccessTokenComponent that are shipped with that release.

The CVSS vector indicates a High severity with a score of 7.5, implying that disclosure of confidential data could enable attackers to gain access to privileged resources in the application. The EPSS score of less than 1 % indicates that, at present, the likelihood of exploitation is low, not listed in the CISA KEV catalog. The likely attack path is a remote request to any of the exposed REST API endpoints; an attacker can simply issue HTTP requests to those endpoints without needing credentials. Once the requests succeed, the API returns sensitive tokens and configuration details verbatim.