In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference
CVSS Metrics