EUVD-2026-65090
GHSA-5vmw-j8f5-4j25
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess authenticated /admin/apikeys page
-
DeliveryView page source or capture proxy/cache log
-
ExploitRead full token from hidden form field
-
ExecutionAuthenticate to API with stolen key
-
ImpactAccess private data per key privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V6 - Authentication Credential protection in transit/storage
|
| Exploitation Conditions | The tokens are disclosed only when the authenticated /admin/apikeys administration page is rendered - so exploitation requires either (a) an authenticated session that can load that admin page, or (b) access to a component that retained the admin HTTP response body (debugging proxy, browser cache, monitoring/observability pipeline, or other intermediary). What LIMITS exploitation: the page is behind admin authentication (contradicting the input's PR:N), so an external unauthenticated attacker cannot fetch it directly and must instead rely on the passive-intermediary path or on being a lower-trust admin; there is no separate user-interaction gadget beyond viewing the page, and impact is bounded by the privileges attached to the specific leaked key. |
| Impact | The signals conflict and warrant scrutiny. The vendor/EUVD CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with all impacts High, score 10.0) implies remote unauthenticated total compromise, but the description explicitly states the keys are exposed only on the AUTHENTICATED /admin/apikeys page - so PR:N is inconsistent with the described precondition and the 10.0 appears inflated. The realistic exposure paths are (1) a logged-in administrator recovering tokens they should not see, and (2) passive capture of the tokens by intermediaries (proxies, caches, monitoring) that logged the admin response - the second path needs positioning on the traffic/log path rather than admin auth. Impact is primarily confidentiality of API credentials (and, transitively, whatever private data those keys unlock), not integrity/availability of the host. No KEV listing and no known POC lower urgency; EPSS is not provided. Net: a legitimate credential-hygiene defect worth patching, but not the drop-everything 10.0 the raw score suggests, especially given the product's small deployment footprint. |
| Exploit ScenarioDerived | An administrator with limited, per-key privileges opens the /admin/apikeys page and uses View-Source (or reads the DOM), recovering the full tokens of other, more-privileged keys embedded in the hidden form fields, then replays one to reach private data beyond their own grant. Equally, a reverse proxy or monitoring system that logs response bodies silently captures every admin's tokens; an attacker with access to those logs harvests and reuses them. No public exploit code is required - the vector is AV:N/AC:L and exploitation is manual inspection of already-served HTML. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 24, 2026
Sensitive credential disclosure in RansomLook (versions 0 through 2.0.0) exposes full API keys in the rendered HTML of the authenticated /admin/apikeys page: although the UI only shows a truncated key, each token is embedded verbatim in hidden form fields backing the enable/disable, private-access, and delete actions. Anyone able to view the admin page source or DOM, or any intermediary that retains HTTP response bodies (debugging proxies, browser caches, monitoring systems), can recover the complete tokens and then authenticate with those keys' privileges, including access to private data. There is no public exploit identified at time of analysis; the issue is fixed upstream by replacing rendered tokens with SHA-256-derived opaque handles.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply commit b358dfa4f40c677a47c602ebbb4473aeae349f5c (https://github.com/RansomLook/RansomLook/commit/b358dfa4f40c677a47c602ebbb4473aeae349f5c), which stops rendering tokens and substitutes SHA-256 opaque handles resolved server-side. Because affected versions run up to 2.0.0, deploy the patched build (or the next tagged release incorporating this commit) and treat any API keys that were ever displayed on the admin page as compromised: rotate/regenerate all existing keys after upgrading, since patching does not retroactively invalidate previously leaked tokens. As interim compensating controls before upgrading, restrict network access to the /admin path to trusted admin IPs (reduces who can render the page), set Cache-Control: no-store on admin responses and purge any browser/proxy caches (limits intermediary retention, at the cost of admins re-fetching), and disable or scrub any HTTP-body logging in reverse proxies and monitoring that sits in front of the app (trade-off: less request debugging visibility).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RansomLook is a Python/Flask web application (see website/web/__init__.py) that tracks ransomware groups and exposes an authenticated administrative interface. The flaw is an instance of CWE-522 (Insufficiently Protected Credentials): API tokens stored in a Redis 'apikeys' hash were injected directly into Jinja2 templates (templates/admin/apikeys.html) as <input type="hidden" name="token" value="{{ k.token }}">. Because the secret lived in the DOM rather than being kept server-side, the truncated on-screen display gave a false sense of protection while View-Source, the raw DOM, and any HTTP-body-retaining component held the real value. The patch introduces _apikey_handle() (a SHA-256 hexdigest of the token) rendered in place of the token, and _resolve_apikey() which maps the submitted handle back to the token server-side using hmac.compare_digest, so the cleartext key is only ever emitted once, at creation time.
Know when Ransomlook gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Tokens render only on the authenticated admin page, so PR:H; disclosure is chiefly credential confidentiality (C:H) with limited integrity via reusable keys (I:L) and no availability impact.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
Lifecycle Timeline
2DescriptionCVE.org
RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete actions.
As a result, API credentials could be recovered by inspecting the page source or DOM. The credentials could also be unintentionally exposed through components that retain or inspect HTTP response bodies, such as debugging proxies, browser caches, monitoring systems, or other intermediaries. An attacker obtaining one of these tokens could subsequently authenticate using the privileges assigned to that key, including access to private data where the key was granted such permissions.
The patch removes API keys from subsequent page rendering and replaces them with SHA-256-derived opaque handles. Administrative actions submit only these handles, which are resolved back to the corresponding token on the server. The full API key is therefore disclosed only once, when it is initially created.
Executive ViewAI
RansomLook versions 0-2.0.0 leak full API credentials in HTTP response bodies and caches despite hiding them in the UI. No public exploit identified at time of analysis, but any cached traffic or browser access-through proxies, monitoring systems, or compromised workstations-exposes valid authentication tokens and customer data. Organizations should assume credential compromise and rotate all affected keys immediately.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Ransomlook
View allBroken authorization in RansomLook's web-based configuration editor (the /admin/config endpoint) lets any authenticated
Unauthenticated private-data disclosure in RansomLook, an open-source ransomware-leak-site tracking platform, allows any
Missing authorization in RansomLook, an open-source ransomware-intelligence tracking platform, lets unauthenticated remo
Unauthenticated remote attackers can create crypto group entries in RansomLook by directly accessing the /admin/crypto/g
Three compounding authentication weaknesses in RansomLook's /login endpoint allow an unauthenticated remote attacker to
Stored XSS in RansomLook's cryptocurrency wallet detail view allows attacker-controlled JavaScript to execute in the sec
Sensitive scraping credentials and bypass logic were exposed to unauthenticated callers through multiple RansomLook API
RansomLook versions through 2.0.0 leaks victim posts belonging to privately configured ransomware groups and markets thr
Path traversal in RansomLook's GroupPost.get API handler allows an attacker controlling a malicious upstream instance to
PDF export in RansomLook allows authenticated analysts to read arbitrary server-side files and conduct server-side reque
Insecure file creation in RansomLook (≤ 2.0.0) exposes the Flask session-signing secret to any local OS user with read a
Redis glob pattern injection in Ransomlook versions up to and including 2.0.0 allows unauthenticated remote attackers to
Exploit-DB