Description
A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument id_token_hint can lead to use of get request method with sensitive query strings. The attack may be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-12
Score: 2.1 Low
EPSS: n/a
KEV: No
Impact: Sensitive data exposure through URL query strings
Action: Apply Patch
AI Analysis

Impact

A flaw in Eleveo Call Recording Software’s logout endpoint allows malicious manipulation of the id_token_hint argument to force the system to issue a GET request that includes sensitive query strings. This results in confidential information being transmitted in the URL, which can be logged or cached by intermediaries. The weakness is classified as CWE-598, indicating sensitive data exposure in unsanitized input handling. The exploit is reported to be possible remotely but has a high complexity and is considered difficult to exploit.

Affected Systems

Eleveo Call Recording Software versions up to and including 10.3.0 are affected. No specific patch version has been listed, and the vulnerability applies to the JWT Token Handler component located at /auth/realms/default/protocol/openid-connect/logout.

Risk and Exploitability

The CVSS score of 2.1 reflects low overall risk, but the lack of a public exploit and the high complexity reduce immediate danger. EPSS data is not available, and there is no listing in the CISA KEV catalog, implying no confirmed active exploitation. The attack vector is remote; while exploitation is difficult, the potential for data leakage warrants proactive mitigation.

Generated by OpenCVE AI on October 12, 2026 at 08:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Eleveo Call Recording Software to a version that addresses the logout endpoint handling or apply any vendor-released patch for the JWT Token Handler component.
  • If an update is not yet available, restrict access to the logout endpoint to authenticated users only and configure the server to reject GET requests with sensitive parameters, forcing the use of a POST method where suitable.
  • Implement monitoring of incoming requests to the logout endpoint for unusual GET parameters and log any abnormal activity for further investigation.

Generated by OpenCVE AI on October 12, 2026 at 08:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument id_token_hint can lead to use of get request method with sensitive query strings. The attack may be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title Eleveo Call Recording Software JWT Token logout get request method with sensitive query strings
First Time appeared Eleveo
Eleveo call Recording Software
Weaknesses CWE-598
CPEs cpe:2.3:a:eleveo:call_recording_software:*:*:*:*:*:*:*:*
Vendors & Products Eleveo
Eleveo call Recording Software
References
Metrics cvssV2_0

{'score': 2.1, 'vector': 'AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 2.6, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 2.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Eleveo Call Recording Software
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-12T06:30:18.796Z

Reserved: 2026-10-11T09:57:14.129Z

Link: CVE-2026-108808

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-12T07:16:35.913

Modified: 2026-10-12T07:16:35.913

Link: CVE-2026-108808

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T08:30:07Z

Weaknesses
  • CWE-598

    Use of HTTP Request With Sensitive Query String