CVE-2026-108808: Use of GET Request Method With Sensitive Query Strings in Eleveo Call Recording Software

This vulnerability in Eleveo Call Recording Software (versions 10.0 through 10.3.0) allows an attacker to manipulate the id_token_hint argument in the JWT Token Handler's logout endpoint, causing sensitive information to be transmitted via the GET request method in query strings. This exposure of sensitive data through GET requests could potentially lead to information leakage. The attack can be launched remotely but requires high complexity to exploit. The vulnerability has been publicly disclosed, but the vendor has not provided any response or fix.

The impact is limited to potential exposure of sensitive query string parameters via GET requests, which may lead to information disclosure. The CVSS 4.0 base score is low (2.1), reflecting the high complexity and limited exploitability. There is no indication of privilege escalation, denial of service, or integrity compromise. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates. Until a fix is released, avoid exposing sensitive tokens in GET request parameters where possible.