EUVD-2026-65090
GHSA-5vmw-j8f5-4j25
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Tokens render only on the authenticated admin page, so PR:H; disclosure is chiefly credential confidentiality (C:H) with limited integrity via reusable keys (I:L) and no availability impact.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete actions.
As a result, API credentials could be recovered by inspecting the page source or DOM. The credentials could also be unintentionally exposed through components that retain or inspect HTTP response bodies, such as debugging proxies, browser caches, monitoring systems, or other intermediaries. An attacker obtaining one of these tokens could subsequently authenticate using the privileges assigned to that key, including access to private data where the key was granted such permissions.
The patch removes API keys from subsequent page rendering and replaces them with SHA-256-derived opaque handles. Administrative actions submit only these handles, which are resolved back to the corresponding token on the server. The full API key is therefore disclosed only once, when it is initially created.
AnalysisAI
Sensitive credential disclosure in RansomLook (versions 0 through 2.0.0) exposes full API keys in the rendered HTML of the authenticated /admin/apikeys page: although the UI only shows a truncated key, each token is embedded verbatim in hidden form fields backing the enable/disable, private-access, and delete actions. Anyone able to view the admin page source or DOM, or any intermediary that retains HTTP response bodies (debugging proxies, browser caches, monitoring systems), can recover the complete tokens and then authenticate with those keys' privileges, including access to private data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The tokens are disclosed only when the authenticated /admin/apikeys administration page is rendered - so exploitation requires either (a) an authenticated session that can load that admin page, or (b) access to a component that retained the admin HTTP response body (debugging proxy, browser cache, monitoring/observability pipeline, or other intermediary). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict and warrant scrutiny. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An administrator with limited, per-key privileges opens the /admin/apikeys page and uses View-Source (or reads the DOM), recovering the full tokens of other, more-privileged keys embedded in the hidden form fields, then replays one to reach private data beyond their own grant. Equally, a reverse proxy or monitoring system that logs response bodies silently captures every admin's tokens; an attacker with access to those logs harvests and reuses them. … |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - apply commit b358dfa4f40c677a47c602ebbb4473aeae349f5c (https://github.com/RansomLook/RansomLook/commit/b358dfa4f40c677a47c602ebbb4473aeae349f5c), which stops rendering tokens and substitutes SHA-256 opaque handles resolved server-side. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running RansomLook versions 0-2.0.0 and audit admin API key access logs for unauthorized usage; begin coordination with the vendor for the patched release. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ransomlook
View allBroken authorization in RansomLook's web-based configuration editor (the /admin/config endpoint) lets any authenticated
Unauthenticated private-data disclosure in RansomLook, an open-source ransomware-leak-site tracking platform, allows any
Missing authorization in RansomLook, an open-source ransomware-intelligence tracking platform, lets unauthenticated remo
Unauthenticated remote attackers can create crypto group entries in RansomLook by directly accessing the /admin/crypto/g
Three compounding authentication weaknesses in RansomLook's /login endpoint allow an unauthenticated remote attacker to
Stored XSS in RansomLook's cryptocurrency wallet detail view allows attacker-controlled JavaScript to execute in the sec
Sensitive scraping credentials and bypass logic were exposed to unauthenticated callers through multiple RansomLook API
RansomLook versions through 2.0.0 leaks victim posts belonging to privately configured ransomware groups and markets thr
Path traversal in RansomLook's GroupPost.get API handler allows an attacker controlling a malicious upstream instance to
PDF export in RansomLook allows authenticated analysts to read arbitrary server-side files and conduct server-side reque
Insecure file creation in RansomLook (≤ 2.0.0) exposes the Flask session-signing secret to any local OS user with read a
Redis glob pattern injection in Ransomlook versions up to and including 2.0.0 allows unauthenticated remote attackers to
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today