The vulnerability allows an attacker to use a bearer token to bypass the passkey-only authentication requirement of the Xerj Console API. By doing so, an unauthenticated or minimally privileged user can directly invoke the token-creation endpoint and mint persistent API tokens. This effectively grants the attacker a long-lived credential that can be leveraged for further requests, enabling unauthorized access and potential lateral movement within systems that rely on those tokens for authentication.

The affected product is Xerj Console API. No specific version numbers are listed in the publicly available data, so all deployed instances of this API may be susceptible unless vendor documentation specifies otherwise.

The CVSS score of 9.1 and an EPSS score of less than 1% indicate a high severity but low current exploitation probability. The vulnerability is not listed in CISA KEV. Exploitation appears achievable via the publicly exposed API endpoint using a standard bearer token, suggesting a remote network attack path. Because the flaw enables the creation of new, persistent credentials, the potential impact is substantial; however, the current EPSS suggests limited real-world exploitation at this time.