CoinEx Crypto EUVD-2026-92063

Exploitation requires the attacker to already hold a valid low-privilege authenticated account (PR:L) on a CoinEx Crypto 2025 deployment and to reach the Customer Information API endpoint /customer-currency/ over the network; the attacker manipulates the user-controlled 'ID' argument to reference records they do not own. The limiting factors are: valid authentication is mandatory (not anonymous), impact is confined to reading another customer's currency data (no modification or service disruption), and the realistic exposure is minimal because the product is apparently retired with no live vendor presence - so few if any instances remain in production. No special non-default configuration is indicated; the flaw appears present in the standard API behavior.

This is a textbook moderate-severity IDOR (CWE-639, authorization bypass through a user-controlled 'ID' key) in the Customer Information API endpoint /customer-currency/ of Omega Solution's CoinEx Crypto 2025. The vendor-assigned CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, VC:L with no integrity or availability impact, E:P) scores 5.3 and aligns with the description: a network-reachable, low-complexity flaw that requires an existing low-privilege authenticated account (PR:L) and yields only limited confidentiality exposure (one customer reading another customer's currency records). Exploitation signals are mixed: a public PoC exists (publicly available exploit code exists), but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active or widespread exploitation - the PoC raises accessibility, not confirmed in-the-wild use. Critically, the product website no longer exists and the product is likely retired/replaced, and the vendor did not respond to disclosure, meaning no patch is available or expected. Net assessment: real but low-priority. The combination of authentication requirement, confidentiality-only impact, likely tiny/retired deployment base, and absence of KEV/EPSS signals indicates a genuine-but-niche issue rather than an urgent threat - far below a 'high CVSS but low real risk' panic case, and more accurately a 'low-everything' case.

An attacker who holds any valid low-privilege customer account on a CoinEx Crypto 2025 instance sends a request to /customer-currency/ while manipulating the 'ID' parameter to reference another customer's identifier. Because the endpoint does not verify object ownership, it returns that other customer's currency information, disclosing data across account boundaries. A public proof-of-concept for this IDOR is available on GitHub, lowering the skill needed to reproduce it.