CVE-2026-108808 in Call Recording Software
Summary
by MITRE • 10/12/2026
A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument id_token_hint can lead to use of get request method with sensitive query strings. The attack may be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The Eleveo Call Recording Software, specifically versions up to 10.3.0, contains a critical security flaw within its JSON Web Token (JWT) handler component. This vulnerability is located in the code responsible for processing logout requests at the endpoint /auth/realms/default/protocol/openid-connect/logout. The core issue stems from improper validation and sanitization of the id_token_hint parameter during the authentication termination process. When a user initiates a logout, the system relies on this token hint to identify the session context. However, due to insufficient input handling, an attacker can manipulate this argument to alter the behavior of the HTTP request method or inject sensitive data into query strings that are not intended for client-side exposure or transmission in plain text formats.
This flaw is classified as a manipulation of arguments vulnerability, which aligns with CWE-88: Argument Injection. The technical mechanism allows an attacker to exploit the trust placed in the id_token_hint field by crafting malicious payloads that force the application to execute GET requests containing sensitive query strings. In standard OAuth 2.0 and OpenID Connect implementations, logout operations should ideally use POST methods or securely handle token revocation without exposing session identifiers or authentication tokens via URL parameters. By leveraging this weakness, an attacker can potentially extract session cookies, access tokens, or other confidential metadata that are inadvertently appended to the request URI during the manipulated logout sequence.
The operational impact of this vulnerability is significant because it enables remote code execution in terms of data exfiltration without requiring prior authentication for certain aspects of the attack vector, although full exploitation may require a valid session context depending on specific implementation details. The complexity level associated with exploiting this flaw is high, indicating that while the exploitability is difficult and requires precise crafting of the id_token_hint parameter to bypass any existing validation logic, it remains feasible for skilled attackers. This difficulty arises from the need to understand the internal state management of the JWT handler and ensure the injected payload triggers the desired GET request behavior with sensitive data exposure rather than resulting in a standard error response.
From an industry framework perspective, this vulnerability maps directly to MITRE ATT&CK technique T1539: Steal Web Session Cookie, as well as aspects of T1078: Valid Accounts if authentication is required to trigger the initial state that allows manipulation. The exposure of sensitive query strings via GET requests violates fundamental security principles regarding data confidentiality and proper HTTP method usage for state-changing operations. Such practices are explicitly discouraged in OWASP guidelines which recommend using POST with appropriate CSRF protections for logout actions to prevent logging of sensitive tokens in server access logs, browser history, or proxy servers.
The fact that the exploit has been publicly disclosed increases the risk landscape significantly, as automated scanners and malicious actors can now utilize known proof-of-concept methods against unpatched instances. The vendor's lack of response to early disclosure attempts suggests a potential gap in their security patching cycle, leaving organizations relying on Eleveo Call Recording Software vulnerable for extended periods. Immediate mitigation strategies should include implementing web application firewall rules that detect and block malformed id_token_hint parameters or restrict the logout endpoint to only accept POST requests with valid CSRF tokens. Additionally, developers must enforce strict input validation on all JWT-related inputs, ensuring that no user-supplied data is directly concatenated into query strings without proper encoding and sanitization checks against injection patterns.