The Acer Connect M6E 5G Portable WiFi Router contains an improper authentication vulnerability (CWE-287) identified as CVE-2026-49191. The issue arises because the production build of the M3WebServer hard-codes backend API keys. These keys can be easily intercepted by attackers through verbose error handling pages that leak sensitive information. This vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

An attacker can intercept hard-coded backend API keys due to verbose error messages, enabling unauthorized access to backend services. This improper authentication flaw can lead to full compromise of the device's management interface or backend functionality, severely impacting confidentiality, integrity, and availability of the device and its network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been provided at this time. Users should monitor Acer's advisories for updates and apply any forthcoming patches promptly.