Edito CMS transmits JWT tokens via GET requests, which can expose tokens in browser history. This exposure allows a local attacker with access to the victim's browser history to obtain a valid JWT token and perform actions on behalf of the victim. The tokens have a short validity period and expire quickly. The vendor assessed the exploitation likelihood as very low and decided that a fix is not necessary.