The vulnerability allows an attacker to use a bearer token to bypass the passkey‑only authentication requirement of the Xerj Console API. By doing so, an unauthenticated or minimally privileged user can directly invoke the token‑creation endpoint and mint persistent API tokens. This effectively grants the attacker a long‑lived credential that can be used for further requests, enabling unauthorized access and potential lateral movement within systems that rely on those tokens for authentication.

The affected product is Xerj Console API. No specific version numbers are listed in the publicly available data, so all deployed instances of this API may be susceptible unless vendor documentation specifies otherwise.

The CVE entry does not provide an EPSS score or a CVSS rating, and this vulnerability is not listed in the CISA KEV catalog. The exploit appears to be achievable via the publicly exposed API endpoint using a standard bearer token, which suggests a remote exploitation path over the network. Because the vulnerability can lead to the creation of new, persistent credentials, the potential impact is high; however, without an explicit CVSS score or exploit prevalence data, the exact level of risk cannot be quantified precisely.