CVE-2026-108808
Received Received - Intake

Authentication Bypass in Eleveo Call Recording Software

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument id_token_hint can lead to use of get request method with sensitive query strings. The attack may be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108808
EUVD
EUVD-2026-97261

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Eleveo Call Recording Software 10.0
Eleveo Call Recording Software 10.1
Eleveo Call Recording Software 10.2
Eleveo Call Recording Software 10.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-598 The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in Eleveo Call Recording Software up to version 10.3.0. It involves a manipulation of the id_token_hint parameter in the JWT Token Handler component, specifically in the /auth/realms/default/protocol/openid-connect/logout file. An attacker can send a crafted request using the GET method with sensitive query strings, potentially exposing sensitive data.

Detection Guidance

This vulnerability involves manipulation of JWT tokens via the logout endpoint in Eleveo Call Recording Software. Detection may involve monitoring for unusual GET requests to /auth/realms/default/protocol/openid-connect/logout with id_token_hint parameters. Check server logs for suspicious query strings or unexpected token handling.

Impact Analysis

The impact includes potential exposure of sensitive information due to the use of sensitive query strings in GET requests. Since the attack has a high complexity and is difficult to exploit, it requires specific conditions and attacker capabilities. However, successful exploitation could lead to unauthorized access to data or session tokens.

Compliance Impact

This vulnerability involves sensitive query strings transmitted via GET requests, which could expose tokens or session data. Such exposure may violate GDPR's data protection principles (e.g., integrity and confidentiality) and HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Upgrade Eleveo Call Recording Software to a version beyond 10.3.0 if available. If no patch exists, restrict access to the /auth/realms/default/protocol/openid-connect/logout endpoint and avoid using sensitive query strings in GET requests. Monitor network traffic for unusual JWT token handling attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108808. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart