JWT Token Handler Issue in Eleveo Call Recording Software
CVE-2026-108808

2.1LOW

Key Information:

Vendor

Eleveo

Status
Call Recording Software
Vendor
CVE Published:
12 October 2026

What is CVE-2026-108808?

A vulnerability in Eleveo Call Recording Software up to version 10.3.0 has been identified, specifically related to the JWT Token Handler. This issue arises from improper handling of the 'id_token_hint' argument within the logout process found in the file /auth/realms/default/protocol/openid-connect/logout. Exploitation of this vulnerability could allow an attacker to manipulate the argument and leverage the GET request method to expose sensitive query strings, leading to potential unauthorized access to confidential information. The complexity of executing an exploit is high, and despite the public disclosure of the vulnerability, the vendor has not provided any response regarding the situation.

Affected Version(s)

Call Recording Software 10.0

Call Recording Software 10.1

Call Recording Software 10.2

References

https://vuldb.com/vuln/416585
vdb-entrytechnical-description
https://vuldb.com/vuln/416585/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108808
third-party-advisory

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ozataknurullah (VulDB User)
VulDB CNA Team
.