CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag.
CVSS 3.0HIGH 7.8·Local·Low privileges·No interaction·EPSS 0.02088·Published 2019-08-05·Fixed in v1.16.0, v6.45.0CWE-522