The application transmits sensitive information over an unencrypted HTTP connection. HTTP does not provide confidentiality or integrity protection, making it possible for attackers to intercept, read, or modify transmitted data via network-based attacks such as Man-in-the-Middle (MITM).

Sensitive data may include authentication tokens, session cookies, user credentials, personal information, or API payloads.

Transmission of sensitive data over HTTP can lead to:

• Interception of credentials or session tokens
• Session hijacking and account takeover
• Exposure of personal or confidential user data
• Manipulation of requests and responses in transit

All sensitive data should be transmitted over HTTPS instead of HTTP.

• CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N