EUVD-2026-64888
GHSA-6q5p-jgh6-cxqm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network API with no complexity; only confidentiality is affected, with no integrity or availability impact and no scope change.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware groups and markets were returned largely verbatim to unauthenticated callers whenever the location itself was not marked as private.
These records could contain internal fields such as header, which may include authentication headers, session cookies, or other credentials used to access monitored websites; init_script, which may contain logic used to bypass CAPTCHA, anti-bot protections, or paywalls; and browser, which discloses details about the scraping environment.
An unauthenticated remote attacker could query the affected API endpoints and obtain these values. Leaked authentication material could potentially be replayed against the monitored service, while disclosure of scraping and bypass logic could allow site operators or other attackers to identify and defeat RansomLook's collection mechanisms.
The patch introduces an explicit allowlist of fields permitted in public location records and strips all operator-side fields before returning data to unauthenticated users.
The accompanying change from <string:postname> to <path:postname> appears to be a functional correction allowing legitimate post titles containing / and does not, based on this patch alone, represent the security issue.
AnalysisAI
Sensitive scraping credentials and bypass logic were exposed to unauthenticated callers through multiple RansomLook API endpoints. Location records associated with monitored ransomware groups and markets were returned verbatim - including the header field containing authentication tokens and session cookies, the init_script field holding CAPTCHA and anti-bot bypass logic, and browser metadata revealing the scraping environment - whenever a location was not explicitly marked private. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required for a remote unauthenticated attacker to retrieve the sensitive fields - the only implicit condition is that a given location record must not have been explicitly marked private by the operator (location.get('private') is not True). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) is internally consistent with the description: unauthenticated network access, no complexity or preconditions, and high confidentiality impact with no integrity or availability effect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker queries RansomLook's public-facing API endpoint for group or market location data - for example, GET /api/v1/group/<name>/locations - without supplying any credentials. The response includes the unredacted `header` field containing HTTP authentication headers or session cookies used by RansomLook to access the monitored site. … |
| Remediation | The primary fix is to update RansomLook from the upstream repository to a commit at or after cc9182930306ff36c7b3424817d49f18df3c85d1, available at https://github.com/RansomLook/RansomLook/commit/cc9182930306ff36c7b3424817d49f18df3c85d1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately revoke all authentication tokens and session cookies exposed through the affected API endpoints, review access logs for unauthorized activity, and notify all dependent systems to re-authenticate with fresh credentials. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ransomlook
View allSensitive credential disclosure in RansomLook (versions 0 through 2.0.0) exposes full API keys in the rendered HTML of t
Broken authorization in RansomLook's web-based configuration editor (the /admin/config endpoint) lets any authenticated
Unauthenticated private-data disclosure in RansomLook, an open-source ransomware-leak-site tracking platform, allows any
Missing authorization in RansomLook, an open-source ransomware-intelligence tracking platform, lets unauthenticated remo
Unauthenticated remote attackers can create crypto group entries in RansomLook by directly accessing the /admin/crypto/g
Three compounding authentication weaknesses in RansomLook's /login endpoint allow an unauthenticated remote attacker to
Stored XSS in RansomLook's cryptocurrency wallet detail view allows attacker-controlled JavaScript to execute in the sec
RansomLook versions through 2.0.0 leaks victim posts belonging to privately configured ransomware groups and markets thr
Path traversal in RansomLook's GroupPost.get API handler allows an attacker controlling a malicious upstream instance to
PDF export in RansomLook allows authenticated analysts to read arbitrary server-side files and conduct server-side reque
Insecure file creation in RansomLook (≤ 2.0.0) exposes the Flask session-signing secret to any local OS user with read a
Redis glob pattern injection in Ransomlook versions up to and including 2.0.0 allows unauthenticated remote attackers to
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today