Atlantis versions up to 0.47.1 expose the /github-app/setup endpoint without requiring authentication, exposing the GitHub App's RSA private key and webhook secret during installation. An attacker who can access the endpoint can capture the redirect flow to extract these credentials, allowing them to mint installation tokens and forge webhook payloads. This flaw is classified as CWE‑306, Authentication Failure, and represents a high confidentiality risk, compromising the credentials that grant control over the GitHub App.

The affected product is runatlantis's Atlantis application. All deployments running Atlantis version 0.47.1 or earlier are vulnerable, as the issue is tied to those releases. No specific patch revision is listed, but the vulnerability description applies to any version lacking the endpoint authentication introduced in later releases.

The CVSS score of 8.8 indicates a high severity vulnerability that can be exploited by any entity that can reach the Atlantis instance over the network. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no documented exploit at the time of this analysis. Attackers can freely issue an unauthenticated HTTP request to /github-app/setup; the lack of access control makes the attack vector straightforward, though the vulnerability does not lead to arbitrary code execution.