PlaywrightCapture mistakenly stored capture‑specific configuration and runtime data as shared, mutable class‑level variables instead of per‑instance variables. As a result, simultaneous or sequential Capture objects running in the same Python process inherit and can overwrite each other’s HTTP headers, cookies, browser storage, credentials, proxy settings, user‑agent strings, geolocation data, and request history. The flaw is therefore a confidentiality and integrity issue that could enable one user to see another user’s authentication tokens, private data, or to cause requests to be sent under another user’s authentication context, potentially accessing or tampering with remote resources.

Lookyloo’s PlaywrightCapture component is affected across all releases that preceded the repository commit introducing instance initialization. The vulnerability is present in any environment where multiple Capture instances share the same process, including multi‑user or concurrent deployments. Specific product versions are not enumerated in the advisory, so all unpatched releases are considered vulnerable.

The CVSS score of 7.1 indicates a high impact risk with moderate exploitation difficulty, yet the EPSS score of less than 1% suggests a very low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need the ability to initiate concurrent Captures within the same Python process, which is feasible in shared or containerized deployment scenarios. Once the condition is met, the attacker can read leaked state or force subsequent captures to use compromised authentication or network settings, leading to unauthorized access or data leakage.