CVE Catalog
CVE-2026-49191
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk0.29%
21th percentile - higher than 21% of all known CVEs
Summary
The production build of M3WebServer hard-codes its backend API keys, which can be easily intercepted through verbose error handling pages.
Risk Assessment
Attackers can intercept API keys and gain unauthorized access to the backend, potentially leading to data theft or manipulation.
Recommendation
Remove hard-coded API keys and use secure credential storage, such as environment variables.
Original NVD description (English source)
The production build of the M3WebServer hard-codes its backend API keys, which can be easily intercepted through verbose error handling pages.