CrossWatch, a synchronization engine, had a GET /api/app‑auth/status endpoint that could be invoked without authentication until version 0.9.21. When accessed, the endpoint returned an "other_sessions" array that exposed metadata for all active sessions, including IP addresses, User‑Agent strings, internal session identifiers, and creation or expiry timestamps. The flaw reflects a CWE‑200 information exposure weakness and also a CWE‑359 session‑token discovery through insufficient authentication. An attacker who can reach the exposed API can enumerate these details for every active session, gaining valuable reconnaissance data but not enabling direct remote code execution or privilege escalation.

The affected product is CrossWatch from Cenodude. Any deployment running a version earlier than 0.9.21 is vulnerable; the vulnerability is fixed in release v0.9.21. The issue is specific to the GET /api/app‑auth/status endpoint of the CW API.

The CVSS base score is 5.3, indicating medium severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. A likely attack vector is a network attacker who can reach the exposed API; no credentials or local privileges are required. The consequence is limited to information disclosure, though the data can aid further attacks by mapping active sessions. The absence of authentication directly corresponds to the identified CWE‑200 and CWE‑359 weaknesses, making remediation a priority.