The vulnerability resides in the way that jack serializes error responses. During an error, the server includes outbound request headers that contain confidential API keys for Radarr or Sonarr, as well as custom Cloudflare Access secrets. This data is exposed through the public error payload, giving any client that knows the shared peer API key and any required Cloudflare credentials full administrative control over the backend media server. The exposed information allows an attacker to execute any operation that the Radarr/Sonarr instance permits, effectively bypassing the designed boundary between friend‑shared access and private backend credentials.

The issue affects all installations of the Roziscoding Jack application running a version older than 0.1.0. The components involved are the error handling middleware, the base server request handling, and the FetchError implementation. No other vendors or earlier releases are impacted by this specific flaw.

With a CVSS score of 8.4 this vulnerability is considered High. An attacker can trigger the error by making a standard HTTP GET request to endpoints such as /peer/items/:id, /servers/health, or /torznab/download/:id, without needing privileged access or user interaction. The EPSS score is currently not available, and it is not listed in CISA’s KEV catalog. Nonetheless, the possibility of obtaining absolute control over a media server via exposed API keys makes this a serious risk for any environment hosting jack with shared peer access enabled.