Eleveo Call Recording EUVD-2026-97261

Exploitation requires that the application's OpenID Connect logout flow at /auth/realms/default/protocol/openid-connect/logout be invoked with the id_token_hint JWT transmitted as a GET query-string parameter, where it becomes recoverable from browser history, referrer headers, proxy caches, or server access logs. Limiting factors are significant: the CVSS vector specifies PR:L (a low-privileged authenticated context is required), UI:P (passive user interaction must occur), and AC:H (high attack complexity, with the vendor explicitly stating exploitability is difficult). Impact is confined to limited confidentiality disclosure (VC:L) of the token, with no integrity or availability effect.

This is a very low-priority issue despite being network-exploitable. The vendor-provided CVSS 4.0 vector (AV:N/AC:H/PR:L/UI:P/VC:L and no integrity or availability impact) yields a base score of only 1.2, reflecting that exploitation is difficult (high attack complexity), requires low-level authentication (PR:L), requires passive user interaction (UI:P), and yields only limited confidentiality disclosure. The underlying weakness (CWE-598) is that the OIDC logout endpoint accepts the id_token_hint as a sensitive value in a GET query string, where it can be exposed via browser history, proxy logs, referrer headers, or server access logs. The E:P flag in the vector and the description both confirm a proof-of-concept exists, but there is NO CISA KEV listing and no EPSS score was provided in the input - absence of EPSS data means widespread-exploitation probability cannot be quantified here. The single reporting source is VulDB, and the vendor was contacted but did not respond, so affected-version and fix data are unconfirmed. Signals are internally consistent (low severity, hard to exploit, POC-only, no active exploitation), so this is a high-CVSS-but-low-real-risk style finding inverted: it is simply a genuinely low-risk, low-severity information-exposure issue, not an urgent priority.

An attacker with a low-privileged authenticated session (or someone able to inspect logs, browser history, or proxy records) observes the id_token_hint JWT passed as a GET query-string parameter to the /auth/realms/default/protocol/openid-connect/logout endpoint and recovers that sensitive token. A proof-of-concept has been publicly disclosed, but high attack complexity and the need for passive user interaction make practical exploitation difficult and limited to low-sensitivity disclosure.