EUVD-2026-92059
GHSA-2j2j-44hv-w69w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege customer
-
DeliveryEnumerate ID values on /customer/ API
-
ExploitManipulate ID to reference other accounts
-
ExecutionBypass authorization check
-
ImpactRead or alter victim profile data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires an authenticated low-privilege account on the CoinEx Crypto web application (PR:L) and network reach to the /customer/ Customer Profile API endpoint, where the ID argument controls which customer record is returned or modified without an ownership check. No user interaction is needed (UI:N) and complexity is low (AC:L). The primary limiting factors are the authentication requirement (an attacker must first obtain or register a valid account) and, significantly, the apparent retirement of the product - its vendor website no longer exists - which means few if any live deployments and no vendor patch are expected. |
| Impact | This is a medium-severity authorization bypass (IDOR, CWE-639) with a genuinely modest real-world risk profile, and the signals are largely consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation but requires PR:L - i.e. an authenticated low-privilege account - so this is not a fully unauthenticated flaw. Impact is capped at VC:L/VI:L/VA:L (limited confidentiality, integrity, and availability), meaning an attacker can likely access or alter other customers' profile data by manipulating the ID parameter but does not gain full system compromise. The E:P marker and the GitHub PoC confirm proof-of-concept exploit code exists, but the CVE is NOT in CISA KEV and no active exploitation is reported; PoC availability must not be conflated with in-the-wild use. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The most important mitigating signal is that the vendor product appears retired (the product website no longer exists) and the vendor did not respond to disclosure, which sharply limits both the installed base and the likelihood of a patch. Net assessment: a real but low-priority issue - authenticated, limited-impact, in an obscure/likely-retired product - not a high-urgency threat despite public PoC availability. |
| Exploit ScenarioDerived | An attacker who holds any valid low-privilege customer account on the CoinEx Crypto platform sends a request to the /customer/ Customer Profile API endpoint and substitutes another customer's identifier in the ID argument. Because the endpoint fails to verify ownership of the referenced object, the attacker reads or modifies the victim's profile data. A public proof-of-concept is available on GitHub, lowering the skill required to reproduce the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 04, 2026
An authenticated low-privilege user of Omega Solution's CoinEx Crypto 2025 web application can bypass authorization on the /customer/ Customer Profile API by manipulating the ID argument, allowing one customer's account to access or modify another customer's profile record - a classic IDOR (CWE-639). The attack is remote, requires no user interaction and minimal complexity, though it does require a valid low-privilege account first; impact is limited to low confidentiality, integrity and availability per the assessed CVSS:3.1 vector (5.3 Medium). Publicly available exploit code exists (a GitHub PoC issue), but there is no indication of confirmed active exploitation, and because the vendor's website no longer exists and the vendor did not respond to disclosure, this appears to be a retired product with few, if any, live deployments and no vendor-released patch.
RemediationAI
No vendor-released patch was identified at time of analysis and the vendor did not respond to the disclosure, so remediation must be compensatory rather than upgrade-based. The strongest action is to decommission the CoinEx Crypto application or take it off the network if it is no longer business-critical, given that the vendor site no longer exists and the product appears retired; if it must remain reachable, place it behind strong authentication and limit network exposure to trusted users only, accepting that this reduces but does not remove the IDOR risk because the flaw lies inside the authenticated API. At the application layer, enforce server-side ownership checks in the Customer Profile API so that the ID argument is validated against the session's authenticated identity before any read or write is performed, and replace predictable, sequential object identifiers with non-enumerable values - noting that opaque identifiers alone are not a fix and must be paired with real authorization checks. Restrict or disable any API routes that return or modify customer records by direct ID until such checks are in place, and monitor logs for sequential or out-of-scope ID enumeration against /customer/ as a detection control. VMware-style per-user data isolation, rate limiting and WAF rules generally cannot reliably detect IDOR traffic, so they should be treated as defense-in-depth only. Note that publicly available exploit code exists at the VulDB-linked GitHub PoC, so any remaining instance should be assumed trivially exploitable by an authenticated user.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause here: the Customer Profile API exposed at /customer/ accepts a client-supplied ID argument and uses it to select the target record without verifying that the authenticated caller actually owns or is entitled to that record. This is the canonical Insecure Direct Object Reference pattern, where the application trusts an identifier supplied by the user as the sole authorization input rather than binding the operation to the session's identity. The affected product is identified by the wildcard CPE cpe:2.3:a:omega_solution:coinex_crypto:*:*:*:*:*:*:*:*, meaning every version of Omega Solution's CoinEx Crypto application - including the 2025 release - is considered affected; no per-version fix information exists. The assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) confirms that the endpoint is network-reachable and that an attacker must already hold a valid low-privilege account on the application, which is the main practical barrier alongside the product's apparent retirement. No user interaction is needed and no special conditions beyond authentication are required, so once an account exists, enumeration or guesswork of the ID argument is sufficient to reach other customers' data.
Know when Coinex Crypto gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable API with low complexity, but a valid low-privilege account is required (PR:L); IDOR yields limited read/write to other users' profile data, so C/I/A are each Low.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in Omega Solution CoinEx Crypto 2025. This affects an unknown function of the file /customer/ of the component Customer Profile API. Executing a manipulation of the argument ID can lead to authorization bypass. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The product web site does not exist anymore. Maybe the product got retired and/or replaced. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB