CVE-2026-108808
2.6LowPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-598
Impact
Remote authenticated attackers can expose sensitive tokens in logs or browser histories if they trick a user into clicking a crafted logout link. Exploitation requires user interaction and specific conditions.
Root cause
The OpenID Connect logout endpoint accepts the id_token_hint parameter via HTTP GET requests instead of strictly requiring POST, exposing sensitive query strings.
Affected systems
Eleveo Call Recording Software up to 10.3.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Fix & remediation
No official patched version is currently available as the vendor has not responded. Restrict or strip the id_token_hint query parameter on GET requests to /auth/realms/default/protocol/openid-connect/logout at the reverse proxy or WAF layer.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument id_token_hint can lead to use of get request method with sensitive query strings. The attack may be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.