CVE-2026-105096: Omega Solution CoinEx Crypto Customer Profile API customer authorization
A vulnerability was determined in Omega Solution CoinEx Crypto 2025. This affects an unknown function of the file /customer/ of the component Customer Profile API. Executing a manipulation of the argument ID can lead to authorization bypass. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The product web site does not exist anymore. Maybe the product got retired and/or replaced. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker with low-level privileges can exploit the authorization bypass by manipulating the ID argument in the Customer Profile API endpoint at /customer/. No user interaction is required.
Is there evidence that exploitation is likely?
A public exploit disclosure exists and may be usable. The vulnerability has a medium severity score of 6.3, with potential low impact to confidentiality, integrity, and availability.
What should teams do if the product is still deployed?
Identify any reachable CoinEx Crypto 2025 deployments and restrict access to the Customer Profile API, especially /customer/, to trusted users and networks. Validate that authenticated users can access only customer records they are authorized to view or modify.
Is a vendor fix available?
The available information does not identify a fix. The product website no longer exists, and the vendor did not respond to the disclosure, so organizations should plan for compensating controls or replacement if the product remains in use.