CVE-2026-105097: Omega Solution CoinEx Crypto Customer Information API customer-currency authorization
A vulnerability was identified in Omega Solution CoinEx Crypto 2025. This impacts an unknown function of the file /customer-currency/ of the component Customer Information API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The product web site does not exist anymore. Maybe the product got retired and/or replaced. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs low-privileged access and can exploit the issue remotely without user interaction. The vulnerable request involves manipulating the ID argument at the /customer-currency/ endpoint.
What is the likely impact of successful exploitation?
Successful exploitation can bypass authorization controls and expose customer-related information. The reported impact is limited to confidentiality; integrity and availability impacts are not reported.
Is exploit code available?
Yes. A public exploit is reported to be available, which increases the likelihood that the issue may be used in attacks.
What should organizations do if they still operate this product?
Identify any deployments of Omega Solution CoinEx Crypto 2025 and restrict access to the Customer Information API, particularly the /customer-currency/ endpoint, to trusted users and networks. The vendor did not respond to disclosure, and the product website is no longer available, so a vendor-supported fix may not be available.