The vulnerability allows an attacker to create a new user account, receive an API key before the account is confirmed, and use that key to subscribe to Server‑Sent Events streams through /pubsub/subscribe/<topic>. The API key is accepted regardless of the account’s is_active or is_confirmed status, enabling access to data that should only be visible to fully active and confirmed users. This read‑only bypass can expose new or not‑yet‑moderated content such as comments, compromising the confidentiality of the event stream.

The affected software is the vulnerability‑lookup product, version information was not provided in the advisory. All installations that use the SSE Pub/Sub interface and generate API keys during self‑registration are potentially impacted.

With a CVSS score of 5.3 the vulnerability is considered moderate, but the lack of an EPSS score means exploitation likelihood is unknown. It is not currently listed in CISA’s KEV catalog. Likely attack steps involve registering an account, awaiting confirmation, and immediately calling the SSE subscription endpoint with the issued API key. The vulnerability stems from inconsistent authorization between the REST API and SSE interface, which can be exploited without special privileges or advanced skills.