FreeScout’s authentication middleware, TokenAuth, creates a static token by hashing the user ID, the account’s creation timestamp, and the application’s secret key (APP_KEY) using MD5. The token never expires or rotates, so the same value remains valid for all sessions. When an attacker obtains the APP_KEY—often exposed through Laravel configuration mis‑management—they can compute a valid token for any user, including administrators, without needing a password. This flaw enables a complete account takeover and can be combined with the related CVE-2026-27636 vulnerability.

All installations of the freescout-help-desk:freescout product that run a version earlier than 1.8.206 are affected. Versions 1.8.206 and later contain the fix and are not vulnerable.

The CVSS score of 9.8 places the vulnerability in the critical range, but the EPSS of less than 1% indicates a very low probability of active exploitation at present. The attack requires discovery of the APP_KEY, after which an attacker can forge a valid token and log in as any user by simply supplying that token. Because the tokens are long‑lived, the risk persists across all sessions until the application is updated or the key is securely rotated. The vulnerability is listed in no KEV catalog.