RansomLook exposed full API keys in the HTML source of the authenticated "/admin/apikeys" page. Although the interface displayed only a shortened representation, the complete token was embedded in hidden form fields used by enable/disable, private‑access, and delete actions. This flaw is a classic information disclosure, allowing an attacker who can view the page source or the DOM to recover the API key. With the key in hand the attacker can authenticate as that key holder, potentially accessing private data or performing actions granted to the key. The vulnerability is captured by CWE‑200 (Information Exposure) and CWE‑522 (Information Exposure Through File or Directory).

The affected product is RansomLook. All installations of RansomLook that expose the "/admin/apikeys" management interface are vulnerable. No specific product version is listed; the vulnerability was identified in a commit to the main branch on 31 July 2026. Administrators should verify if their instance matches the codebase referenced in the advisory.

The CVSS score of 9.4 indicates critical severity. The EPSS score is not available, which means the exploitation probability is not quantified but the vulnerability remains highly damaging. The flaw is listed as not in the CISA KEV catalog. An attacker needs authenticated access to the admin area to view the page; however, once an API key is disclosed it can be used remotely by any party. The lack of additional monitoring or rate limiting elevates the likelihood of exploitation. Based on the description, the likely attack vector is an authenticated admin accessing the page; the most dangerous outcome is the unprivileged disclosure of credentials that can then grant broader access.