The Brightpick Mission Control web application contains hardcoded credentials embedded in its client-side JavaScript bundle. These credentials are exposed through the documentation portal, allowing an attacker with access to the client-side code to obtain them. This vulnerability is categorized under CWE-523 (Exposure of Credentials). The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact.

Exposure of hardcoded credentials in client-side code can allow unauthorized parties to access protected resources or systems that rely on these credentials. The confidentiality of sensitive information is compromised, but there is no direct impact on integrity or availability according to the CVSS vector. This could lead to information disclosure or unauthorized access depending on how the credentials are used.

No patch or official fix is currently available for this vulnerability. Users and administrators should monitor the vendor's advisory channels for updates. As a temporary mitigation, avoid deploying or exposing client-side code containing hardcoded credentials and consider rotating any exposed credentials immediately if possible.