CVE-2025-66573 — Solstice Pod API Session Key Extraction via API Endpoint
Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint (`/api/config`) that exposes sensitive information such as the session key, server version, product …
Published: 2025-12-04 · CVSS: 6.9 · CVSS 4.0
Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint (`/api/config`) that exposes sensitive information such as the session key, server version, product details, and display name. Unauthorized users can extract live session information by accessing this endpoint without authentication.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7