PlaywrightCapture in Lookyloo improperly stores capture-specific configuration and runtime data as mutable class-level variables rather than instance variables. This design flaw allows multiple Capture objects running concurrently or sequentially in the same Python process to share sensitive state such as HTTP headers, cookies, credentials, proxy settings, and captured request data. As a result, information from one capture can leak into another, risking disclosure of authentication data and enabling unauthorized access or interference with other capture operations. The vulnerability affects versions up to and including 1.40.2. The fix involves initializing all capture-specific data as instance variables in the Capture constructor to ensure isolation between capture operations.

The vulnerability can lead to disclosure of sensitive authentication cookies, credentials, browser storage, and captured request data across different capture sessions. It may also cause requests to be executed with another capture's authentication context or proxy configuration, potentially enabling unauthorized access to remote resources or interference with other users' capture operations. This compromises confidentiality and integrity of captured data in multi-user or concurrent deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is resolved by initializing capture-specific settings and data as instance variables to isolate state between captures. Until an official fix is available, avoid running multiple concurrent captures within the same Python process or isolate capture operations to prevent state sharing.