Description
A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/realms/default/protocol/openid-connect/logout. The manipulation leads to session expiration. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-12
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Forced Logout (Denial of Service)
Action: Monitor
AI Analysis

Impact

A flaw in Eleveo Call Recording Software allows an attacker to manipulate the /auth/realms/default/protocol/openid-connect/logout endpoint, forcing a session termination for authenticated users. The vulnerability derives from an authentication mechanism weakness (CWE‑613) and results in legitimate users being abruptly logged out, interrupting service continuity without compromising data confidentiality or integrity.

Affected Systems

Eleveo Call Recording Software releases up to and including version 10.3.0 are affected. No vendor‑issued patch or advisory has been released, and the vendor has not responded to early disclosures. The affected component is the logout processing of the OpenID Connect protocol within the software.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity. EPSS information is not available and the vulnerability is not listed in CISA KEV. The likely attack vector is remote via crafted HTTP requests to the logout endpoint; exploitation does not require privileged access or lead to data theft, but it can be used to perform denial of service by enforcing unexpected logout of legitimate users.

Generated by OpenCVE AI on October 12, 2026 at 08:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Contact Eleveo support or vendor to obtain a patch or advisory as soon as one is released.
  • Disable or restrict access to the /auth/realms/default/protocol/openid-connect/logout endpoint for unauthenticated or suspicious traffic, using firewall rules or application‑level controls.
  • Modify the logout workflow to require additional confirmation before terminating a session, if the software allows custom logic changes.
  • Deploy monitoring of logout activity and generate alerts for unexpected or frequent logout events to detect exploitation attempts.

Generated by OpenCVE AI on October 12, 2026 at 08:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/realms/default/protocol/openid-connect/logout. The manipulation leads to session expiration. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Eleveo Call Recording Software logout session expiration
First Time appeared Eleveo
Eleveo call Recording Software
Weaknesses CWE-613
CPEs cpe:2.3:a:eleveo:call_recording_software:*:*:*:*:*:*:*:*
Vendors & Products Eleveo
Eleveo call Recording Software
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Eleveo Call Recording Software
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-12T06:45:17.979Z

Reserved: 2026-10-11T09:57:17.636Z

Link: CVE-2026-108809

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-12T07:16:36.127

Modified: 2026-10-12T07:16:36.127

Link: CVE-2026-108809

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T09:00:14Z

Weaknesses
  • CWE-613

    Insufficient Session Expiration