The vulnerability resides in the Werkzeug Debugger PIN Handler component of 666ghj MiroFish. By manipulating the SECRET argument of the /console endpoint, an attacker can cause the application to disclose console information. This leads to a confidentiality breach, allowing the remote extraction of potentially sensitive internal data. The weakness is documented as CWE‑200 (Information Exposure) and CWE‑284 (Improper Authorization).

Vendors and products affected are 666ghj and MiroFish, with vulnerable releases through version 0.1.2. The issue is tied to the /console endpoint of the Werkzeug Debugger PIN Handler. No other vendors or product versions are listed as impacted.

The CVSS score of 6.3 indicates moderate‑to‑high severity, while the EPSS score of less than 1% shows a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote via manipulation of the SECRET argument, requires high complexity, and is considered difficult to exploit, though a public exploit exists. Overall, the risk is moderate but warrants attention.