An unauthenticated SQL injection exists in the '/linkinfo' endpoint handled by the `get linkinfo()` function. Remote attackers can use the `source se` and `dest se` query parameters to perform blind injection, allowing them to read stored cloud storage credentials and token provider client secrets.