Description

A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument id_token_hint can lead to use of get request method with sensitive query strings. The attack may be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.6",
  "pubDate": "2026-10-12T07:16:35.913Z",
  "pubdate": "2026-10-12T07:16:35.913Z",
  "executiveSummary": "A vulnerability exists in Eleveo Call Recording Software up to version 10.3.0 within the JWT Token Handler component.\nThe vulnerability involves the improper handling of the id_token_hint argument during an OpenID Connect logout process.\nBy manipulating the id_token_hint, an attacker can force the application to perform a GET request that includes sensitive information within the query string.\nThis flaw enables remote attackers to potentially intercept sensitive tokens or session-related data via log files, proxy headers, or browser history.\nWhile the exploitability is classified as difficult and requires high attack complexity, the existence of public exploit disclosure poses a risk to systems where sensitive identity tokens are handled.\nThe vendor has remained unresponsive to notifications regarding this security defect, leaving the current implementation without official remediation.",
  "technicalDetails": "The vulnerability resides in the /auth/realms/default/protocol/openid-connect/logout endpoint, which serves as the OpenID Connect (OIDC) logout handler.\nThe root cause is an insecure implementation of the logout logic where the id_token_hint parameter is processed and propagated through the system without sufficient sanitization or secure transmission protocols.\nWhen an attacker crafts a malicious GET request targeting the logout endpoint, they can manipulate the id_token_hint argument to include unintended data.\nThe application subsequently incorporates this manipulated input into the query string of a subsequent HTTP request initiated by the server-side JWT Token Handler.\nBecause the sensitive data is appended to the URL as a query string, it is logged in plain text by web servers, reverse proxies, and intermediate security appliances, and may be cached by browsers.\nThe attack flow follows a remote exploitation vector: 1) The attacker identifies a target instance of Eleveo Call Recording Software. 2) The attacker crafts a request to the /auth/realms/default/protocol/openid-connect/logout path, injecting malicious, payload-specific strings into the id_token_hint parameter. 3) The server parses the argument and generates an outbound request using the GET method, effectively leaking the sensitive token hint into logs or clear-text monitoring environments. 4) The attacker monitors exposed log files or network traffic to retrieve the sensitive data, which can then be leveraged to potentially facilitate session hijacking or identity impersonation.\nThe complexity of this attack is categorized as high, indicating that the attacker must navigate specific server configurations or timing conditions to successfully capture the leaked information, though the public availability of exploit details lowers the barrier to entry for motivated actors.\nAs the component is responsible for JWT Token handling, the leakage of token-related data presents a critical risk to the authentication and authorization integrity of the affected Eleveo environments.\nNo patches have been provided by the vendor to address the insecure parameter handling at the specified file path, requiring defensive action at the infrastructure level."
}