This vulnerability (CVE-2025-1029) in SoliClub arises from the use of hard-coded credentials (CWE-798) within the software executable. Versions 5.2.4 through before 5.3.7 are affected. An attacker can remotely access sensitive constants embedded in the executable without authentication or user interaction. The CVSS 3.1 base score is 7.5, reflecting high confidentiality impact but no integrity or availability impact. No patch or official fix details are currently available, and the product is not a cloud service.

The vulnerability allows an unauthenticated remote attacker to read sensitive information embedded as hard-coded credentials within the SoliClub executable. This exposure can lead to confidentiality breaches, potentially enabling further attacks if the credentials are reused or provide access to critical systems. There is no reported impact on integrity or availability. No known exploits have been observed in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting network access to affected SoliClub instances and monitor for unusual access patterns. Avoid relying on hard-coded credentials in software development and plan to upgrade to a fixed version once released.