CVE-2026-105097 in CoinEx Crypto
Summary
by MITRE • 10/04/2026
A vulnerability was identified in Omega Solution CoinEx Crypto 2025. This impacts an unknown function of the file /customer-currency/ of the component Customer Information API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The product web site does not exist anymore. Maybe the product got retired and/or replaced. The vendor was contacted early about this disclosure but did not respond in any way.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/04/2026
The identified vulnerability resides within the Customer Information API of Omega Solution CoinEx Crypto 2025, specifically affecting an unknown function associated with the /customer-currency/ endpoint. This flaw represents a critical failure in access control mechanisms, allowing for unauthorized manipulation of user data through argument tampering. The core technical issue is classified as Broken Access Control, which aligns directly with CWE-639 from the Common Weakness Enumeration database. In this scenario, an attacker can modify specific input arguments, particularly the ID parameter, to bypass intended authorization checks. This type of vulnerability typically arises when the application fails to properly verify that a user has permission to perform actions on resources they do not own or are not authorized to access. The lack of proper validation allows malicious actors to escalate privileges or access sensitive customer information by altering identifiers in API requests.
The operational impact of this vulnerability is severe due to its remote exploitability and the nature of the data involved. Since the flaw enables authorization bypass, an attacker can potentially view, modify, or delete customer currency details without valid authentication credentials for those specific accounts. This compromises the confidentiality and integrity of user financial information stored within the system. The fact that a public exploit is available significantly lowers the barrier to entry for attackers, increasing the likelihood of automated scanning and exploitation attempts against vulnerable instances. Organizations running this software are at immediate risk of data breaches, leading to potential regulatory penalties under frameworks such as GDPR or CCPA due to the exposure of personally identifiable information combined with financial data.
The context surrounding this disclosure highlights additional risks related to product lifecycle management. The vendor has not responded to early contact regarding this security issue, and their official website is no longer accessible, suggesting that the product may have been retired or replaced. This lack of ongoing support means there are likely no available patches or updates to remediate the flaw for existing deployments. Consequently, any organization still utilizing Omega Solution CoinEx Crypto 2025 must treat this vulnerability as a permanent risk unless they can implement compensating controls at the network perimeter or application layer. The absence of vendor engagement underscores the importance of maintaining an accurate inventory of software assets and ensuring that legacy systems are either decommissioned or isolated from untrusted networks to mitigate exposure.
To mitigate the risks associated with this authorization bypass, organizations should prioritize isolating any remaining instances of the affected component behind strict firewall rules that restrict access to known internal IP addresses only. Implementing Web Application Firewalls can help detect and block requests containing manipulated ID parameters if specific patterns are identified in existing logs. Additionally, reviewing API gateway configurations for proper authentication enforcement is critical, ensuring that every request requires valid session tokens or API keys regardless of the input data provided. Given the retired status of the product, migrating to a supported alternative solution remains the most effective long-term strategy to eliminate this attack vector entirely and ensure compliance with modern security standards such as those outlined in MITRE ATT&CK technique T1078 for Valid Accounts misuse within enterprise environments.