Skip to main content

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2025-46332

Medium
6.5/10

Summary

Flags SDK is an open-source feature flags toolkit for Next.js and SvelteKit. Impacted versions flags and @vercel/flags, in certain circumstances allows a bad actor with detailed knowledge of the vulnerability to list all flags returned by the flags discovery endpoint (".well-known/vercel/flags"). This vulnerability allows for Information Disclosure, where a bad actor could gain access to a list of all feature flags exposed through the flags discovery endpoint, including the "flag names", "flag descriptions", available options and their labels (e.g. `true`, `false`), and default flag values. This vulnerability affects @vercel/flags package and flags package versions prior to 4.0.0.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-200 - Information Exposure

An information exposure vulnerability is categorized as an information flow (IF) weakness, which can potentially allow unauthorized access to otherwise classified information in the application, such as confidential personal information (demographics, financials, health records, etc.), business secrets, and the application's internal environment.

References

Advisory Timeline

  • Published