CVE-2026-108809
Received Received - Intake

Session Expiration Flaw in Eleveo Call Recording Software

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/realms/default/protocol/openid-connect/logout. The manipulation leads to session expiration. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108809
EUVD
EUVD-2026-97262

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Eleveo Call Recording Software 10.0
Eleveo Call Recording Software 10.1
Eleveo Call Recording Software 10.2
Eleveo Call Recording Software 10.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Eleveo Call Recording Software up to version 10.3.0. It involves improper handling of the logout process at /auth/realms/default/protocol/openid-connect/logout, allowing session expiration manipulation. An attacker can remotely exploit this to terminate active user sessions without proper authorization.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized session handling in Eleveo Call Recording Software up to version 10.3.0. Inspect web server logs for unusual logout requests to /auth/realms/default/protocol/openid-connect/logout. Monitor for unexpected session terminations or failed authentication attempts.

Impact Analysis

This vulnerability could allow unauthorized users to log out active users, disrupting call recording sessions. It may lead to loss of critical call data or unauthorized access to sensitive information during active sessions. The exploit is publicly available, increasing the risk of real-world attacks.

Compliance Impact

This vulnerability could impact compliance by potentially exposing recorded calls or session data. GDPR requires protecting personal data, and HIPAA mandates secure handling of health information. Session termination risks may lead to unauthorized access or data loss, violating these regulations.

Mitigation Strategies

Immediately update Eleveo Call Recording Software to the latest version beyond 10.3.0. If an update is unavailable, restrict access to the /auth/realms/default/protocol/openid-connect/logout endpoint via firewall rules. Review and revoke any suspicious active sessions. Implement network monitoring for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108809. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart