What is the CVSS score of CVE-2026-27637?

CVE-2026-27637 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-27637?

Yes, a public proof-of-concept exploit is available for CVE-2026-27637. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-27637?

Within 24 hours: Identify all FreeScout installations and their versions; isolate or disable public-facing instances running versions before 1.8.206. Within 7 days: Apply vendor patch to version 1.8.206 or later across all FreeScout deployments; conduct authentication logs review for suspicious token usage. Within 30 days: Rotate all user credentials and session tokens post-patching; implement enhanced logging and monitoring for authentication anomalies; assess whether customer or internal data was accessed during vulnerability window.

Freescout CVE-2026-27637

CRITICAL

Use of Insufficiently Random Values (CWE-330)

2026-02-25 security-advisories@github.com

Laravel Freescout

9.8

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain FreeScout APP_KEY from Laravel config exposure
Delivery

Compute MD5(user_id + created_at + APP_KEY) token
Exploit

Send crafted request with static token
Execution

Authenticate as administrator
Impact

Achieve full account takeover

Vulnerability Assessment

Weakness	CWE CWE-330 OWASP Top 10:2025 A04:2025 - Cryptographic Failures ASVS 5.0 V11 - Cryptography Cryptographic random values
Exploitation Conditions	FreeScout versions prior to 1.8.206 with exposed APP_KEY (common in Laravel deployments where .env or configuration files are accessible via directory traversal, git exposure, or misconfigured web servers). Token-based authentication enabled in TokenAuth middleware without expiration/rotation mechanisms.
Impact	CVSS 9.8, EPSS 0.19%. Help desk systems contain customer correspondence and may have integrations with internal systems.
Exploit ScenarioDerived	Attacker triggers password reset for admin account, predicts the reset token based on weak PRNG, completes the reset to take over the account.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Predictable password reset tokens in FreeScout help desk before 1.8.206. Weak random number generation allows attackers to predict reset tokens and take over accounts. PoC and patch available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:55 CVSS 9.8

Predictable password reset tokens in FreeScout help desk.

RemediationAI

Update to FreeScout 1.8.206. Use cryptographically secure random token generation.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-330 weak PRNG for password reset token generation. Tokens can be predicted, enabling account takeover through password reset.

Know when Freescout gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Feb 26, 2026 - 16:08 vuln.today

Public exploit code

Patch released

Feb 26, 2026 - 16:08 nvd

Patch available

CVE Published

Feb 25, 2026 - 04:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's TokenAuth middleware uses a predictable authentication token computed as MD5(user_id + created_at + APP_KEY). This token is static (never expires/rotates), and if an attacker obtains the APP_KEY - a well-documented and common exposure vector in Laravel applications - they can compute a valid token for any user, including the administrator, achieving full account takeover without any password. This vulnerability can be exploited on its own or in combination with CVE-2026-27636. Version 1.8.206 fixes both vulnerabilities.

Executive ViewAI

Why It Matters

FreeScout versions prior to 1.8.206 contain a critical authentication bypass vulnerability that allows attackers to forge valid user session tokens using predictable MD5 hashing. Any organization running vulnerable FreeScout instances faces immediate risk of unauthorized access to help desk systems, customer communications, and sensitive support data without requiring legitimate credentials.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If immediate patching is not possible: implement network-level access controls restricting FreeScout to trusted IP ranges only; disable TokenAuth authentication method if alternative authentication mechanisms are available; deploy WAF rules to detect MD5-based token patterns in authentication headers; enable enhanced audit logging for all authentication events; consider temporary service shutdown until patch can be applied.

Threat Intelligence Overview

EPSS Score

0.2%

Top 59% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Affected Products (CPE)GitHub Advisory

cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:*

More in Freescout

View all

CVE-2026-28289 CRITICAL Act Now POC

10.0 Mar 03

File upload bypass in FreeScout 1.8.206 — patch bypass for CVE-2026-27636. PoC and patch available. CVSS 10.0.

CVE-2026-27636 HIGH Act Now POC

8.8 Feb 25

Remote code execution in FreeScout prior to version 1.8.206 allows authenticated users to upload `.htaccess` files that

CVE-2026-53595 CRITICAL Act Now POC

9.4 Jul 20

Anonymous account takeover in FreeScout help desk before 1.8.224 lets an unauthenticated attacker seize the lowest-id ac

CVE-2024-29185 CRITICAL Act Now POC

9.0 Mar 22

FreeScout is a self-hosted help desk and shared mailbox. Rated critical severity (CVSS 9.0), this vulnerability is remot

CVE-2025-58163 HIGH This Week POC

8.6 Sep 03

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Rated high severity (CVSS 8.6), this

CVE-2024-29184 HIGH This Week POC

8.0 Mar 22

FreeScout is a self-hosted help desk and shared mailbox. Rated high severity (CVSS 8.0), this vulnerability is remotely

CVE-2024-28186 HIGH This Week POC

7.1 Mar 12

FreeScout is an open source help desk and shared inbox built with PHP. Rated high severity (CVSS 7.1), this vulnerabilit

CVE-2024-34698 MEDIUM This Month POC

6.3 May 14

FreeScout is a free, self-hosted help desk and shared mailbox. Rated medium severity (CVSS 6.3), this vulnerability is r

CVE-2024-34697 MEDIUM This Month POC

6.1 May 14

FreeScout is a free, self-hosted help desk and shared mailbox. Rated medium severity (CVSS 6.1), this vulnerability is r

CVE-2026-32754 CRITICAL Act Now

9.3 Mar 19

A stored cross-site scripting (XSS) vulnerability exists in FreeScout help desk software versions 1.8.208 and below, whe

CVE-2026-41193 CRITICAL Act Now

9.1 Apr 21

Arbitrary file write in FreeScout (prior to 1.8.215) allows authenticated administrators to achieve remote code executio

CVE-2026-41902 CRITICAL Act Now

9.1 May 07

Unauthenticated account takeover in FreeScout versions prior to 1.8.217 allows remote attackers to gain permanent access

Same weakness CWE-330 – Use of Insufficiently Random Values

View all

CVE-2017-6026 CRITICAL POC

9.1

CVE-2022-36536 CRITICAL POC

9.8

CVE-2022-44938 CRITICAL POC

9.8

CVE-2022-22922 CRITICAL POC

9.8

CVE-2021-41694 CRITICAL POC

9.8

CVE-2021-28024 CRITICAL POC

9.8

CVE-2021-27200 CRITICAL POC

9.8

CVE-2019-15130 CRITICAL POC

9.8

References

Advisories & patches

PATCH https://github.com/freescout-help-desk/freescout/commit/004a8231f6e413af1d4680930b0e2342fd4283f9 REF https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-mw88-x7j3-74vc

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back