Description

A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/realms/default/protocol/openid-connect/logout. The manipulation leads to session expiration. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-10-12T07:16:36.127Z",
  "pubdate": "2026-10-12T07:16:36.127Z",
  "executiveSummary": "A session management vulnerability exists within Eleveo Call Recording Software versions up to 10.3.0. The flaw resides in the handling of logout requests directed at the /auth/realms/default/protocol/openid-connect/logout endpoint.\nThis vulnerability allows an unauthorized remote actor to trigger premature session termination for active users. By manipulating requests sent to the identified OpenID Connect logout endpoint, an attacker can effectively perform a Denial of Service (DoS) attack against authenticated user sessions.\nThe vulnerability is characterized by improper validation or handling of logout signals, leading to unauthorized session invalidation. Because the exploit is publicly available, the risk to affected deployments is elevated.\nNo specific authentication is required to initiate this attack, making it reachable via the network for any remote actor capable of reaching the target instance. The primary impact is the disruption of service for end-users, potentially impacting critical call recording operations and workflow continuity.\nThe vendor has not provided a resolution for this issue, necessitating manual defensive configurations to prevent exploitation.",
  "technicalDetails": "The vulnerability is located in the authentication module of Eleveo Call Recording Software, specifically involving the /auth/realms/default/protocol/openid-connect/logout endpoint. This endpoint serves as the OIDC-compliant termination point for user sessions, typically responsible for clearing tokens and destroying server-side session state.\nThe root cause stems from the application's failure to properly authenticate or validate the intent of the logout request. In an OIDC environment, the logout process usually expects specific, authorized parameters or a verified session context associated with the user performing the action. In the affected versions of Eleveo, the implementation improperly processes these requests, allowing a remote attacker to inject or craft a request that triggers the session invalidation logic without legitimate authorization.\nThe attack flow proceeds as follows: An attacker identifies the target server and monitors for valid OIDC logout requests or manually constructs a malicious payload targeting the /auth/realms/default/protocol/openid-connect/logout endpoint. When the application receives this malformed or unauthorized logout request, it executes the backend function responsible for clearing the session associated with the target account. This effectively destroys the session object on the server, forcing the legitimate user to lose their authenticated state and be redirected to the login page.\nThe exploitation does not require prior authentication or elevated privileges, as the endpoint is exposed at the application's authentication entry point. The network exposure is broad, as the endpoint is typically reachable via public interfaces to facilitate SSO and federated authentication workflows.\nThe post-exploitation impact is limited to session termination and the disruption of ongoing operations. While this does not appear to facilitate arbitrary code execution or direct unauthorized data access, it enables a reliable, reproducible denial-of-service vector against individual users or, depending on the implementation details, potentially broader groups of users. The existence of a publicly available exploit lowers the barrier to entry for attackers, increasing the likelihood of this vulnerability being leveraged in disruptive campaigns against organizations using the software."
}