This vulnerability in 666ghj MiroFish (up to version 0.1.2) involves an information disclosure issue in the Werkzeug Debugger PIN Handler component, located in the /console file. Manipulating the SECRET argument remotely can lead to unauthorized information disclosure. The attack complexity is high, and no privileges or user interaction are required. The vulnerability has a CVSS 4.0 score of 6.3 (medium severity). No official patch or remediation has been provided by the vendor, and the exploit code is publicly available.

Successful exploitation can lead to unauthorized disclosure of sensitive information via the Werkzeug Debugger PIN Handler. This could potentially expose internal debugging data or secrets that may aid further attacks. However, the attack complexity is high and exploitability is difficult, which reduces the likelihood of widespread exploitation. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, restricting access to the /console endpoint and limiting exposure of the Werkzeug Debugger component may reduce risk.