Eleveo Call Recording EUVD-2026-97262

Exploitation targets the Keycloak OpenID Connect logout endpoint (/auth/realms/default/protocol/openid-connect/logout) in Eleveo Call Recording Software versions up to and including 10.3.0, where session state is not fully invalidated (CWE-613 insufficient session expiration). Limiting factors: the attacker must already hold a low-privileged authenticated session (PR:L - not an anonymous attack), and passive user interaction is required (UI:P), such as a victim performing or relying on a logout action; the resulting impact is confined to minor confidentiality exposure (VC:L) with no integrity or availability effect. No non-default configuration is indicated in the available data.

This is a genuinely low-priority issue despite being remotely reachable. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) scores just 2.0, and all signals align on low real-world risk: the only impact is minor confidentiality (VC:L) via improper session expiration (CWE-613), with no integrity (VI:N) or availability (VA:N) consequence. Exploitation requires low-level authentication (PR:L) and passive user interaction (UI:P/E:P indicates a proof-of-concept exploit exists), which further constrains practical abuse. There is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation - the publicly available PoC indicates reproducibility, not weaponization. Note a context cue worth verifying: the affected endpoint /auth/realms/default/protocol/openid-connect/logout is a standard Keycloak OpenID Connect logout path, implying the flaw lies in the embedded/bundled Keycloak identity layer of Eleveo rather than proprietary recording code - confirm with the vendor, though the vendor was reportedly unresponsive to the disclosure. The input 'Information Disclosure' tag only loosely fits CWE-613; treat the disclosure framing cautiously.

An attacker with a low-privileged authenticated session leverages a flaw in the Keycloak OpenID Connect logout endpoint so that a session is not properly expired, allowing a session artifact to remain valid after an expected logout. With victim interaction (e.g., using a shared or previously-used browser/kiosk), the attacker can reuse the lingering session to access limited recorded-call data. A public proof-of-concept exists, making the behavior reliably reproducible.