The Solstice Pod API in versions 5.5 and 6.2 contains an unauthenticated endpoint (/api/config) that leaks sensitive information such as session keys and server details. This exposure allows attackers to retrieve live session information without authentication, violating confidentiality principles. The vulnerability is classified under CWE-319 for cleartext transmission of sensitive information. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, no privileges required, and no user interaction needed.

Unauthorized users can access sensitive session information including session keys, which could compromise the confidentiality of active sessions and potentially allow further unauthorized access or session hijacking. The exposure of server version and product details may also aid attackers in crafting targeted attacks. However, there is no indication of privilege escalation or direct system compromise from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Solstice Pod API endpoints to trusted networks or authenticated users only, if possible. Monitor for any updates from mersive regarding patches or configuration changes to mitigate this vulnerability.