| Titre | Omega Solution CoinEx Crypto latest Authorization Bypass |
|---|
| Description | Omega Solution CoinEx Crypto 2025 contains an Insecure Direct Object Reference (IDOR) vulnerability in the customer information retrieval functionality. The application fails to enforce object-level authorization when processing requests to the customer resource endpoint and directly trusts a user-controlled customer identifier to determine which record is returned. An authenticated customer can manipulate the identifier in the request path to access sensitive information belonging to arbitrary customers without authorization. Successful exploitation results in unauthorized disclosure of customer profile information, financial wallet data, cryptocurrency account details, and password hashes, allowing horizontal privilege escalation and compromising the confidentiality of sensitive customer information.
Affected Component:
Customer Information API
Affected Endpoint:
GET /customer-currency/{id}
Affected Parameter:
{id}
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-639: Authorization Bypass Through User-Controlled Key
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-862: Missing Authorization
OWASP Top 10 2021: A01 – Broken Access Control
OWASP API Security Top 10: API1 – Broken Object Level Authorization |
|---|
| La source | ⚠️ https://github.com/4m3rr0r/PoCVulDb/issues/25 |
|---|
| Utilisateur | 4m3rr0r (UID 85795) |
|---|
| Soumission | 17/07/2026 19:50 (il y a 3 mois) |
|---|
| Modérer | 03/10/2026 11:43 (3 months later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 413346 [Omega Solution CoinEx Crypto 2025 Customer Information API /customer-currency/ id élévation de privilèges] |
|---|
| Points | 20 |
|---|