CVE-2026-103098: GV-Eye Sensitive information exposure in URL query parameter Vulnerability
Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key
Affected Software
Event History
Frequently Asked Questions
Who is able to exploit this issue?
An attacker who can monitor network traffic between GV-Eye and the destination receiving the HTTP request could intercept the plaintext request and obtain the sensitive key.
What access or interaction is required to obtain the key?
No privileges or user interaction are required according to the supplied vector. The attacker needs network-monitoring capability on a path where the unencrypted HTTP request is transmitted.
What is the immediate mitigation if a fix cannot be applied?
Ensure the affected request is transmitted over HTTPS rather than unencrypted HTTP, so the sensitive key is not sent in plaintext across the network.