CVE-2025-34188 is a CWE-532 vulnerability affecting Vasion Print Virtual Appliance Host and Application versions prior to 1.0.735 and 20.0.1330 respectively. The issue arises from the local logging mechanism storing sensitive authentication session tokens (PHPSESSID, XSRF-TOKEN, laravel_session) in cleartext within log files that are world-readable. This allows any local user with access to the host machine to retrieve these tokens and use them to bypass authentication controls on the SaaS environment, potentially gaining unauthorized access and exposing sensitive data. The vulnerability is identified by the vendor as V-2022-008 — Secrets Leaked in Logs. The CVSS 4.0 score is 8.4, indicating high severity with local attack vector, low complexity, no user interaction, and high impact on confidentiality and integrity.

The vulnerability allows local users with access to the affected host to extract authentication session tokens from log files and use them to authenticate remotely to the SaaS environment without valid credentials. This can lead to unauthorized access to the system and exposure of sensitive information. The impact is rated high due to the potential for privilege escalation and data compromise. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to the affected machines to trusted users only and consider limiting log file permissions to prevent unauthorized reading of session tokens. Monitor vendor communications for updates on patches or official mitigations.