CVE-2026-108809: Eleveo Call Recording Software logout session expiration
A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/realms/default/protocol/openid-connect/logout. The manipulation leads to session expiration. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access and interaction are required to exploit this issue?
The attack can be performed remotely, but the severity vector indicates that the attacker needs low-level privileges and user interaction. Exploitation has low attack complexity.
Which deployments may be affected?
Eleveo Call Recording Software versions up to 10.3.0 may be affected. The available information does not identify a specific configuration or deployment condition.
What is the likely security impact?
The reported effect is session expiration. The severity vector rates confidentiality impact as low and indicates no integrity or availability impact.
Is public exploit code available?
Yes. The vulnerability information states that an exploit is publicly available and may be used.
Is a vendor fix or response confirmed?
No vendor response is documented in the available information. The disclosure notes that the vendor was contacted early but did not respond.