The wyzie-open-redeem IPC handler in Streambert removes the Content‑Security‑Policy header from all responses in the redeem window’s Electron session and does not restrict calls to open new windows. A malicious third‑party resource such as sub.wyzie.io or any site navigated to from that window can thus load attacker‑controlled script without CSP constraints. The injected script runs in the renderer process, providing direct access to renderer‑exposed APIs and allowing chaining with other local vulnerabilities to exfiltrate data or control internal services. This flaw represents a classic reflected XSS weakness (CWE‑79) combined with improper configuration that reduces effective security controls (CWE‑693).

The vendor truelockmc:streambert is affected. Versions 2.5.0 through, but not including, 2.6.0 contain the vulnerable wyzie-open-redeem handler. The issue specifically impacts the Electron desktop application used to stream and download video content.

The CVSS score of 6.9 indicates a moderate severity rating. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that there is no known widespread exploitation at the time of analysis. The exploit requires a user to open the Wyzie API key redemption window and for an attacker to supply a page containing malicious script – typically via a third‑party domain loaded in that window. Given that the vulnerability can be chained with other local flaws and can affect other windows and persistent storage, the risk to a compromised user of the application is non‑trivial, warranting forward deployment of the fixed version.