CVE-2026-108809CWE-613

CVE-2026-108809

Low · published October 12, 2026

CVSS v3.1
3.5
EPSS
0%
Percentile
7.2
In the wild
Unconfirmed
What it is

A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/realms/default/protocol/openid-connect/logout. The manipulation leads to session expiration. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00180 · 7.2th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-10-12T11:16Z
References (4)
https://vuldb.com/cve/CVE-2026-108809 · [email protected]https://vuldb.com/submit/963576 · [email protected]https://vuldb.com/vuln/416586 · [email protected]https://vuldb.com/vuln/416586/cti · [email protected]
EPSS history
Timeline
  • 13 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 12 OCT 06:45Z
    Eleveo Call Recording Software logout session expiration
    cvelistv5
  • 12 OCT 06:45Z
    Eleveo Call Recording Software logout session expiration
    cvelistv5