CVE-2026-108809

Executive Summary

CVE-2026-108809 is a session expiration (session fixation/invalidation) vulnerability in Eleveo Call Recording Software up to version 10.3.0, affecting the OpenID Connect logout endpoint at /auth/realms/default/protocol/openid-connect/logout. A remote, low-privileged attacker can manipulate this endpoint to force session expiration, resulting in a limited-scope availability/confidentiality impact rated CVSS 3.5 (Low). Although the attack requires user interaction and yields only limited impact, a public exploit is available and the vendor did not respond to coordinated disclosure, leaving all installations of Eleveo up to 10.3.0 unpatched and exposed.

Technical Analysis

The vulnerability is classified as CWE-613: Insufficient Session Expiration. The affected component is the OpenID Connect (OIDC) logout endpoint exposed by Eleveo's identity layer at the well-known path:

/auth/realms/default/protocol/openid-connect/logout

This path structure is characteristic of a Keycloak-based or Keycloak-compatible authentication realm (/auth/realms/{realm}/protocol/openid-connect/logout). The realm in this case is named default. OpenID Connect defines a standard RP-Initiated Logout endpoint. Under the OIDC specification, this endpoint is intended to be invoked by a relying party to terminate the user's session at the OpenID Provider (OP), optionally redirecting the browser afterward.

The flaw lies in how the logout endpoint handles session termination. Rather than requiring valid session context, a proper CSRF-resistant token, or an id_token_hint tied to the requestor's own session, the endpoint can be manipulated such that a session is expired. The NVD description states: "The manipulation leads to session expiration." Because the effect is session invalidation rather than session hijacking, the confidentiality/integrity impact is limited. However, forced session expiration against an authenticated user constitutes a denial-of-service condition at the session layer and can be leveraged as a precursor to re-authentication phishing or credential-capture attacks: the victim is silently logged out and re-prompted for credentials, which an attacker positioned on the network or via a look-alike portal may harvest.

The CVSS vector AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N indicates:

• AV:N (Network) — exploitable remotely over the network, no adjacency required.
• AC:L (Low) — no special conditions beyond standard deployment.
• PR:L (Low) — the attacker needs low-level privileges (a valid, minimally privileged authenticated account or session context).
• UI:R (Required) — the victim must perform some interaction (e.g., visiting a crafted link that invokes the logout endpoint on their behalf).
• S:U (Unchanged) — the vulnerable component's authority is not exceeded.
• C:L (Low) — limited confidentiality impact, consistent with the re-authentication/phishing escalation vector.

The NVD description explicitly notes that the issue affects "some unknown processing" of the endpoint. This phrasing indicates the exact parameter or request construction that triggers the session expiration was not disclosed in the CNA record. The vendor was reportedly contacted early but did not respond, and the exploit is publicly available.

Important accuracy note: No function names, parameter names (e.g., post_logout_redirect_uri, id_token_hint, client_id), or request bodies are confirmed by the source data. Any specific parameter-level mechanism is therefore inferred from the OIDC logout endpoint class and the CWE-613 categorization, not stated as fact.

Exploitation Scenarios

The attack chain below is inferred from the vulnerability class (insufficient session expiration at an OIDC logout endpoint) and the NVD description. No public PoC sample, payload, or parameter list was provided in the source data. All steps are described at the vulnerability-class level.

1. Reconnaissance / Target Identification An attacker scans for internet- or intranet-exposed Eleveo Call Recording Software instances up to version 10.3.0. Identification is performed by fingerprinting the login page and the presence of the OIDC endpoint path /auth/realms/default/protocol/openid-connect/logout. Shodan dorks (see METADATA) can locate candidate hosts. The default realm name default is a reliable indicator of a standard deployment.

2. Triggering the Flaw Class Because the flaw is CWE-613 (insufficient session expiration via a logout endpoint), the attacker crafts a request to the OIDC logout endpoint that terminates a target user's session. The manipulation does not require elevated privileges (PR:L) but does require the victim to interact (UI:R) — typically by loading an attacker-crafted link or embedded resource (image/iframe) that causes the victim's browser to issue the logout request against the Eleveo authentication endpoint while the victim's authenticated session cookie is present.

3. Payload / Execution Method (class-level) The execution method is a crafted cross-site request to the logout endpoint. The exact parameters or request construction that produce the session expiration were not disclosed and are not reproduced here. Since the vector is AV:N/AC:L, no authentication bypass, memory corruption, or code execution is involved — the impact is purely session-state manipulation.

4. Post-Exploitation Impact The affected user's session is forcibly expired. Practically, this logs the user out of the Call Recording Software interface and forces a re-authentication prompt. The C:L score reflects the limited leak potential: an attacker who controls the re-authentication flow (e.g., via a convincing look-alike login page delivered immediately after forced logout) could capture credentials. Additionally, repeated forced logouts against recording/QA operators constitute a targeted availability nuisance and can disrupt workflows if the session is lost mid-task.

The vulnerability does not grant access to recorded calls, does not achieve remote code execution, and does not provide privilege escalation. Any exploitation claim beyond session expiration should be treated as unsupported.

Impact Assessment

• Affected Systems: All deployments of Eleveo Call Recording Software at version 10.3.0 or earlier. Call recording platforms are typically deployed in contact centers, financial services, healthcare, and regulated environments where call records are sensitive.
• Confidentiality (C:L): Limited. The direct effect is session termination, not data exposure. Confidentiality impact arises indirectly if forced logout enables credential-harvesting via re-authentication.
• Integrity (I:N): None per the CVSS vector.
• Availability (A:N): None per the CVSS vector, though operational disruption from forced logouts of recording operators is a practical nuisance. CVSS scores an availability-neutral effect, and this report adheres to that.
• Scope (S:U): Unchanged — the vulnerable authentication component does not extend its authority to other components.
• Blast Radius: Limited per session per exploit attempt, but the exploit is publicly available and remotely triggerable, so the aggregate impact across an entire agent workforce can be significant if used to disrupt operations or to seed credential-phishing campaigns.
• Business Impact: Contact centers relying on uninterrupted recording sessions may experience agent workflow interruptions. Because call recording is often a compliance requirement, forced session termination that results in missed recordings could carry regulatory implications.

Detection Guidance

Sigma Rule

title: Eleveo OIDC Logout Endpoint Abuse (CVE-2026-108809)
id: 3f9a1c2e-7b41-4d8e-9a2c-1e5b6d7f8a90
status: experimental
description: Detects requests to the Eleveo OpenID Connect logout endpoint consistent with session-expiration abuse
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108809
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.impact
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/auth/realms/default/protocol/openid-connect/logout'
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  condition: selection_path and selection_method
fields:
  - c-ip
  - cs-uri-query
  - cs(User-Agent)
  - sc-status
falsepositives:
  - Legitimate RP-initiated logout by authorized relying parties
  - Single sign-out flows in normal user sessions
level: low

YARA Rule

rule CVE_2026_108809_Eleveo_OIDC_Logout_Abuse
{
    meta:
        description = "Detects references to the Eleveo OIDC logout endpoint associated with CVE-2026-108809"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108809"
        date = "2026-01-01"
        severity = "low"

    strings:
        $endpoint = "/auth/realms/default/protocol/openid-connect/logout" ascii wide nocase
        $oidc1 = "openid-connect" ascii wide nocase
        $oidc2 = "realms/default" ascii wide nocase
        $eleveo = "Eleveo" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D or
        ($endpoint) or
        (2 of ($oidc*) and $eleveo)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108809 Eleveo OIDC Logout Endpoint Session Expiration Attempt"; flow:established,to_server; http.uri; content:"/auth/realms/default/protocol/openid-connect/logout"; nocase; http.method; content:"GET"; http.method; content:"POST"; classtype:attempted-dos; reference:cve,2026-108809; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-108809; sid:2026108809; rev:1;)

alert http any any -> any any (msg:"CVE-2026-108809 Eleveo OIDC Logout Endpoint Request"; flow:established,to_server; http.uri; content:"/auth/realms/default/protocol/openid-connect/logout"; nocase; classtype:web-application-activity; reference:cve,2026-108809; sid:2026108810; rev:1;)

(Note: Suricata does not support content negation across methods on a single rule; deploy the first rule as a broad matcher or refine per-inline signature tooling. The second rule provides a higher-fidelity single-URL match.)

Elastic Detection

network where
  network.protocol == "http" and
  url.path : "/auth/realms/default/protocol/openid-connect/logout" and
  http.request.method in ("GET", "POST")

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:plus:kv
| where match(uri_path, "/auth/realms/default/protocol/openid-connect/logout")
| stats count AS requests, dc(src_ip) AS unique_sources, values(user_agent) AS agents BY src_ip, uri_path, status
| where requests > 5
| sort - requests

This flags repeated invocations of the logout endpoint from the same source, a strong signal of abuse versus legitimate single-session logout.

Wazuh OSSEC Rule

<group name="web,eleveo,cve-2026-108809,">
  <rule id="202610880" level="5">
    <decoded_as>web-accesslog</decoded_as>
    <url>/auth/realms/default/protocol/openid-connect/logout</url>
    <description>CVE-2026-108809: Eleveo OIDC logout endpoint accessed - possible session expiration abuse</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="202610881" level="8" frequency="6" timeframe="60">
    <if_matched_sid>202610880</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-108809: Repeated Eleveo OIDC logout requests from same source - probable exploitation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor was contacted but did not respond. No fixed version is available. The following are defensive measures only; they do not constitute a vendor patch.

1) Immediate Mitigations

• Restrict network exposure. Do not expose the /auth/realms/default/protocol/openid-connect/logout endpoint (or the Eleveo application as a whole) to untrusted networks. Place the authentication layer behind a VPN, zero-trust proxy, or firewall allow-list.
• Enforce same-site cookies. Configure the OIDC session cookies with SameSite=Strict or SameSite=Lax where the platform permits, reducing the ability of cross-site requests to invoke the logout endpoint with active session context.
• Add CSRF controls at the reverse proxy. Insert a WAF/proxy rule requiring a valid CSRF token or a same-origin Origin/Referer header on requests to the logout endpoint. Reject requests lacking these.
• Rate-limit logout invocations. Throttle repeated requests to the logout path per source IP to blunt denial-of-service style forced-logout campaigns.
• User awareness. Warn contact-center staff that unexpected repeated logout prompts may be adversarial and instruct them not to enter credentials into any re-authentication page reached via an external link.

2) Patch / Upgrade Steps

• No vendor patch exists at the time of writing. Track the Eleveo vendor advisory channel and the NVD entry for a fixed release. If Eleveo publishes a corrected version, upgrade immediately and verify the logout endpoint enforces session-context or token validation.
• Because the underlying authentication layer appears Keycloak-compatible, evaluate whether an updated Keycloak/identity-provider release with hardened RP-initiated logout handling can be layered in front of or under the Eleveo deployment — consult vendored support before making changes.

3) Long-Term Hardening

• Perform a formal review of the OIDC integration to ensure logout requests are bound to the requesting session and validated against an id_token_hint or equivalent context.
• Adopt a software bill of materials (SBOM) process to track embedded identity-provider components.
• Implement continuous monitoring (rules above) for abnormal logout-endpoint traffic.
• Establish a vendor-risk process for products that do not respond to coordinated disclosure, and factor non-response into procurement decisions.

References

• NVD — CVE-2026-108809: https://nvd.nist.gov/vuln/detail/CVE-2026-108809
• CWE-613: Insufficient Session Expiration — https://cwe.mitre.org/data/definitions/613.html
• OpenID Connect RP-Initiated Logout 1.0 specification: https://openid.net/specs/openid-connect-rpinitiated-1_0.html
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• Eleveo product information (vendor): https://www.eleveo.com/

Exploit-in-the-wild / threat actor note: The NVD description states a public exploit is available and "might be used." As of this report, CISA KEV does not list CVE-2026-108809, and no specific threat actor campaign has been attributed. No PoC code, exploit file, or Nuclei template is available from the tracked sources.