This vulnerability (CVE-2024-12604) affects Tap&Sign App versions before 1.025 and is characterized by cleartext storage of sensitive data in environment variables (CWE-526) and a weak password recovery mechanism (CWE-640). The cleartext storage exposes sensitive information that could be accessed by unauthorized parties. The weak password recovery mechanism may allow attackers to exploit the password reset process, potentially leading to unauthorized access or misuse of app functionality. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and partial confidentiality and integrity impact without availability impact. There is no vendor advisory or patch available at this time, and no known exploits have been reported in the wild.

The vulnerability could lead to partial disclosure of sensitive information due to cleartext storage and potential unauthorized password recovery exploitation. This may result in limited confidentiality and integrity impacts, such as unauthorized access to user accounts or misuse of application functionality. There is no indication of availability impact or widespread exploitation currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be cautious with the Tap&Sign App versions prior to 1.025 and consider limiting exposure of sensitive environment variables. Monitor vendor communications for updates on patches or mitigations.