| Título | Eleveo Call Recording Software 10.3.0 CWE-598 |
|---|
| Descrição | Eleveo Call Recording Software 10.3.0 transmits the user's JWT as a URL query string parameter during the logout GET request. This exposes the token in server access logs, proxy logs, browser history, and HTTP Referer headers sent to third-party services.
Evidence:
--- Logout Request ---
GET /auth/realms/default/protocol/openid-connect/logout?client_id=encourage-js-client&post_logout_redirect_uri=https%3A%
2F%2F[HOST]%2Fapp%2Fconversations%2Fconversations&id_token_hint=[MASKED TOKEN] HTTP/1.1
Host: [HOST]
Cookie: KEYCLOAK_LOCALE=en-US; AUTH_SESSION_ID=[MASKED]
Referer: https://[HOST]/app/conversations/conversations
Priority: u=0, i
Connection: keep-alive
--- Logout Response ---
HTTP/1.1 302
Date: Fri, 28 Aug 2026 15:14:40 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive |
|---|
| Utilizador | ozataknurullah (UID 101077) |
|---|
| Submissão | 07/09/2026 16h14 (há 2 meses) |
|---|
| Moderação | 11/10/2026 11h57 (1 month later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 416585 [Eleveo Call Recording Software até 10.3.0 JWT Token logout id_token_hint Divulgação de Informação] |
|---|
| Pontos | 17 |
|---|