API Key Manager CVE-2025-9553

The target must be a Drupal installation with the contributed 'API Key manager' module installed and enabled; the vulnerability affects all versions ('*.*') per the sparse NVD data, so no specific version boundary is confirmed. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication or user interaction is required and exploitation is remote against reachable instances. The practical limiting factor is deployment footprint rather than configuration: this is a niche contributed module, not Drupal core, so exposure is confined to the subset of Drupal sites that have specifically installed it. The exact feature, endpoint, or configuration that triggers the disclosure is not described in the available data and should be confirmed against Drupal SA-contrib-2025-103.

This is a moderate-severity information disclosure flaw in the Drupal contributed 'API Key manager' module, rated CVSS 5.3 with a vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicating network-reachable, low-complexity, unauthenticated exploitation affecting only confidentiality at a LOW level. The signals are internally consistent but point to a low real-world priority rather than an emergency: EPSS is 0.25% (15th percentile), indicating low predicted exploitation probability; the CVE is NOT in CISA KEV; and no public POC is referenced. No SSVC decision data or CWE was supplied. The 'LOW' confidentiality impact combined with an information-disclosure classification suggests partial exposure of data (plausibly API keys or configuration, given the module's name) rather than full compromise. The description is extremely sparse ('API Key manager: *.*') and provides no technical detail, CWE, or affected version boundary, so the exact nature and scope of the disclosure cannot be confirmed from the data. Net assessment: a legitimately network-reachable unauthenticated issue, but low EPSS, no KEV, and no POC make this a patch-on-normal-cycle item, not a drop-everything priority.

A remote, unauthenticated attacker sends a crafted request to a Drupal site running the API Key manager module and receives sensitive information the module should not expose (consistent with the 'Information Disclosure' tag and LOW confidentiality impact). No public exploit code is referenced, and the low attack complexity means no special timing or conditions are needed, though the disclosed data is limited in scope per the CVSS C:L rating.