The report
Presenton's Electron desktop application starts local frontend and backend services. In the reported Windows build, the authentication switch resolved to disabled by default, letting local clients call APIs without presenting a user identity. A separate report identified a broad static file mount of the application-data directory. Together, the findings made local configuration, SQLite records and material containing AI provider credentials reachable in the researcher's reproduction.
These are two distinct implementation boundaries. The authentication issue concerns who may call the local service. The file-serving issue concerns which stored files that service may return. The published tests used a particular desktop release; an attacker on an unrelated website would still need a workable route through browser origin checks or DNS rebinding. The reports do not show confirmed customer theft across operating systems.
A desktop app can become a credential API
Software that helps a user generate presentations may legitimately hold keys for external AI providers. That increases the consequence of serving a whole application-data directory through a generic HTTP route. A model can be operating correctly while its surrounding application leaks the credentials used to pay for inference.
Removing the file mount and protecting keys in an OS credential store address different problems from enabling authentication. The Case keeps the two issue reports and their verification limits together rather than converting a local reproduction into a confirmed remote compromise.