CVE-2026-108808

Executive Summary

CVE-2026-108808 is an information-disclosure vulnerability in Eleveo Call Recording Software (versions up to and including 10.3.0) affecting the JWT Token Handler component at the endpoint /auth/realms/default/protocol/openid-connect/logout. By manipulating the id_token_hint argument, an attacker can cause sensitive data to be transmitted via an HTTP GET request query string, exposing tokens or associated data to logging, proxy, and browser-history leakage (CWE-598). The vulnerability is remotely exploitable, requires high attack complexity and user interaction, and carries a CVSS 3.1 base score of 2.6. A public disclosure exists, and the vendor was contacted but did not respond, leaving the product unpatched as of this report.

Technical Analysis

The vulnerability resides in the OpenID Connect (OIDC) logout flow exposed by Eleveo's authentication stack at /auth/realms/default/protocol/openid-connect/logout. The affected component is described as the JWT Token Handler, and the manipulable argument is id_token_hint.

In standard OIDC logout flows, the id_token_hint parameter is passed to the relying party or identity provider to identify the session being terminated. The CWE-598 classification (Use of GET Request Method With Sensitive Query Strings) indicates that the application accepts this sensitive parameter via the query string of a GET request rather than requiring a POST body or a header. As a result, the token value is embedded in the URL itself.

This creates multiple leakage channels inherent to the vulnerability class:

• Web server access logs, reverse-proxy logs, and load-balancer logs frequently record full request URLs, including query strings.
• Tokens embedded in URLs may be retained in browser history, HTTP Referer headers when navigating to third-party resources, and intermediary caches.
• Analytics, monitoring, and CDN platforms that capture request URIs can inadvertently retain the sensitive value.

The NVD description states that "executing a manipulation of the argument id_token_hint can lead to use of get request method with sensitive query strings." Per the CRITICAL ACCURACY constraints, no specific function names, class names, or internal parsing routines are asserted here beyond what the source description provides. The precise internal handling of id_token_hint (validation, signature checks, replay protection) is not detailed in the available intelligence.

The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) indicates:

• Network attack vector, remotely reachable.
• High attack complexity — exploitation depends on conditions outside the attacker's direct control (e.g., presence of logging, referer leakage, or prior capture of a valid token hint).
• Low privileges required.
• User interaction required.
• Confidentiality impact is Low; Integrity and Availability impacts are None.

The "exploitability is difficult" statement and high complexity reflect the narrow conditions under which a token is exposed and then recoverable. Nonetheless, NVD confirms the exploit has been publicly disclosed.

Insufficient technical detail is available regarding the exact token validation logic, token lifetime, and whether the leaked value is a full JWT or an identifier. Analysts should treat these as unknowns rather than assume details.

Exploitation Scenarios

No public PoC (Proof of Concept) code, Nuclei template, or exploit script is available in the provided data, although NVD states the exploit "has been publicly disclosed and may be utilized." The following attack chain is described strictly at the vulnerability-class level.

1. Reconnaissance / Target Identification An attacker identifies internet-exposed Eleveo Call Recording deployments. The relevant surface is the OIDC logout endpoint at /auth/realms/default/protocol/openid-connect/logout. Fingerprinting could leverage the presence of this authentication path or the Eleveo product footprint.

2. Triggering the Flaw The attacker crafts a request or link to the logout endpoint that includes an id_token_hint argument passed via the GET method query string. Per CWE-598, the sensitive token value is then transmitted as part of the URL rather than in a request body. Since user interaction is required (UI:R), the attack likely involves enticing a victim to click a crafted logout link or to navigate to a URL containing a token hint.

3. Execution / Leakage Mechanism The value supplied in id_token_hint travels in the query string. Sensitive query strings are commonly captured by server logs, proxies, and browser history. The attacker's objective is to obtain a leaked token value from one of these channels. Because the parameter handling issue is a leakage condition rather than code execution, the "payload" is a crafted URL containing the id_token_hint parameter — the exact value required to elicit leakage is not documented in the available sources.

4. Post-Exploitation Impact Because the CVSS impact is limited to Low confidentiality with no integrity or availability effect, the realistic post-exploitation outcome is exposure of sensitive token data. Depending on the token's semantics, this could aid session-related reconnaissance. The high complexity and requirement for user interaction constrain practical exploitation. No evidence of lateral movement, code execution, or data modification is supported by the CVSS vector or description.

Impact Assessment

The CVSS 3.1 base score is 2.6 (Low). Subscore interpretation:

• Confidentiality: Low (C:L) — exposure of sensitive query-string data, potentially token information.
• Integrity: None (I:N) — the vulnerability does not permit modification of data.
• Availability: None (A:N) — no service disruption is described.
• Attack Vector: Network (AV:N) — remotely exploitable.
• Attack Complexity: High (AC:H) — exploitation depends on favorable conditions.
• Privileges Required: Low (PR:L) — limited prior access.
• User Interaction: Required (UI:R) — a victim must be induced to act.
• Scope: Unchanged (S:U) — impact is confined to the vulnerable component.

Business impact is primarily confidentiality-related. For organizations running Eleveo Call Recording Software, leaked session/token material recorded in logs or histories can undermine authentication hygiene, particularly in regulated environments where call-recording systems process sensitive communications. Blast radius is limited by the high complexity and user-interaction requirements, but any deployment up to 10.3.0 that exposes the OIDC logout endpoint is in scope. EPSS has not yet scored this CVE; no exploit-in-the-wild evidence is provided beyond public disclosure, and CISA KEV does not list it.

Detection Guidance

Sigma Rule

title: Eleveo OIDC Logout id_token_hint Leakage via GET Query String
id: 7f3b9c41-2a6d-4e18-9c2b-5ad10e6f9b3c
status: experimental
description: Detects requests to the Eleveo/Keycloak OIDC logout endpoint containing id_token_hint in the query string, indicating CWE-598 sensitive-query-string exposure.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108808
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains: '/auth/realms/default/protocol/openid-connect/logout'
  selection_query:
    cs-uri-query|contains: 'id_token_hint='
  condition: selection_path and selection_query
falsepositives:
  - Legitimate OIDC logout flows that pass id_token_hint in the query string
level: low
tags:
  - attack.t1190
  - cwe.598

YARA Rule

rule CVE_2026_108808_Eleveo_OIDC_Logout_TokenLeak
{
    meta:
        author = "valtersit.com"
        description = "Detects OIDC logout requests carrying id_token_hint in query strings (CVE-2026-108808, CWE-598)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108808"
        date = "2026-01-01"
        severity = "low"

    strings:
        $endpoint = "/auth/realms/default/protocol/openid-connect/logout" ascii wide nocase
        $param = "id_token_hint=" ascii wide nocase

    condition:
        any of ($endpoint*) and any of ($param*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108808 Eleveo OIDC Logout id_token_hint Leakage in Query String"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/auth/realms/default/protocol/openid-connect/logout"; http.uri; content:"id_token_hint="; nocase; classtype:attempted-recon; reference:cve,2026-108808; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-108808; sid:2026108808; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method == "GET"
      and url.path == "/auth/realms/default/protocol/openid-connect/logout"
      and url.query contains "id_token_hint=" ]

Splunk SPL Query

index=web OR index=proxy
| eval uri=coalesce(uri, url, request_url)
| where like(uri, "%/auth/realms/default/protocol/openid-connect/logout%") AND like(uri, "%id_token_hint=%")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as sample_uri by src_ip, dest_host
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,eleveo,cve-2026-108808,">
  <rule id="2026108" level="3">
    <decoded_as>web-accesslog</decoded_as>
    <url>/auth/realms/default/protocol/openid-connect/logout</url>
    <match>id_token_hint=</match>
    <description>CVE-2026-108808: Eleveo OIDC logout request with id_token_hint in query string (potential sensitive token leakage via GET).</description>
    <group>cwe_598,attack_t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations

• Restrict network exposure of the /auth/realms/default/protocol/openid-connect/logout endpoint to trusted networks where feasible, reducing the remote attack surface.
• Configure web servers, reverse proxies, load balancers, and CDNs to redact or strip query strings from access logs and telemetry, specifically masking id_token_hint.
• Enforce a Referrer-Policy (e.g., no-referrer or strict-origin) on authentication pages to reduce token leakage via the Referer header to third parties.
• Disable or minimize third-party analytics/scripts on authentication endpoints to prevent URI retention.
• Reduce token lifetimes and enable revocation on the identity provider side to limit the value of any leaked token hint.

2. Patch / Upgrade Steps

• No vendor patch is available; the vendor was contacted and did not respond. There is no fixed version. Monitor the Eleveo vendor site and OSV/NVD entries for updates. Do not assume any version is fixed.

3. Long-Term Hardening

• Prefer POST-based or header-based transmission of sensitive parameters over GET query strings in applications under your control.
• Adopt structured log redaction at the pipeline level rather than relying solely on application fixes.
• Maintain asset inventory of internet-exposed authentication endpoints and continuously monitor for OIDC-related anomalies.
• Re-evaluate the deployment if the underlying identity stack (the endpoint path strongly resembles Keycloak) can be upgraded or patched independently of the Eleveo product.

References

• NVD — CVE-2026-108808: https://nvd.nist.gov/vuln/detail/CVE-2026-108808
• CWE-598 — Use of GET Request Method With Sensitive Query Strings: https://cwe.mitre.org/data/definitions/598.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Eleveo (vendor) — product site, monitor for advisories (no advisory issued as of this report)
• CISA Known Exploited Vulnerabilities catalog — not listed (checked; no KEV entry for this CVE)

No named threat actor campaigns or confirmed exploit-in-the-wild evidence are documented in the provided data. NVD states the exploit has been publicly disclosed and "may be utilized," but no PoC/exploit code, Nuclei template, or OSV package mapping was available for verification.