What’s Vulnerable › Vulnerabilities

CVE-2025-66573: Solstice Pod API Session Key Extraction via API Endpoint

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-04 · updated 2026-10-18
• Weakness: CWE-319

Description

Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint (`/api/config`) that exposes sensitive information such as the session key, server version, product details, and display name. Unauthorized users can extract live session information by accessing this endpoint without authentication.

Affected products

• mersive Solstice Pod API: 5.6, 6.2

References

• https://documentation.mersive.com/en/solstice/about-solstice.html
• https://www.exploit-db.com/exploits/52104
• https://www.mersive.com/
• https://www.vulncheck.com/advisories/solstice-pod-api-session-key-extraction-via-api-endpoint
• https://www.exploit-db.com/exploits/52104

Get alerted when CVE-2025-66573 or the next vulnerability affects your stack