Omega Solution CoinEx Crypto API Vulnerabilities

Authorization bypass (IDOR) in Omega Solution's CoinEx Crypto 2025 allows an authenticated low-privilege user to read other customers' currency records by tampering with the 'ID' argument on the Customer Information API endpoint /customer-currency/. Exploitation is remote, requires a valid low-privilege account, and yields limited confidentiality impact only - no data modification or service disruption (CVSS 3.1 5.3/5.3, PR:L, C:L). Publicly available exploit code exists (a VulDB PoC referenced on GitHub), but there is no confirmation of active exploitation in the wild, and realistic exposure is minimal because the product appears retired with no functioning vendor site and an unresponsive vendor.

Authenticated information disclosure in Omega Solution CoinEx Crypto 2025 allows a low-privilege user to retrieve support-ticket data by manipulating the status, page, or count parameters in the /ticket/customer API endpoint. The affected product appears retired, its vendor site is no longer available, and the vendor did not respond to disclosure attempts, so no vendor-released patch is identified. Publicly available exploit code exists, but exploitation requires valid credentials and only exposes read-only ticket information, keeping real-world risk low to moderate; no confirmed active exploitation (CISA KEV) is reported.

An authenticated low-privilege user of Omega Solution's CoinEx Crypto 2025 web application can bypass authorization on the /customer/ Customer Profile API by manipulating the ID argument, allowing one customer's account to access or modify another customer's profile record - a classic IDOR (CWE-639). The attack is remote, requires no user interaction and minimal complexity, though it does require a valid low-privilege account first; impact is limited to low confidentiality, integrity and availability per the assessed CVSS:3.1 vector (5.3 Medium). Publicly available exploit code exists (a GitHub PoC issue), but there is no indication of confirmed active exploitation, and because the vendor's website no longer exists and the vendor did not respond to disclosure, this appears to be a retired product with few, if any, live deployments and no vendor-released patch.