CVE-2026-108809: Session Expiration in Eleveo Call Recording Software

This vulnerability affects Eleveo Call Recording Software up to version 10.3.0. It stems from an issue in processing the OpenID Connect logout endpoint, allowing an attacker to manipulate session expiration remotely. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity, with network attack vector, low complexity, and requiring low privileges and user interaction. No vendor response or patch information is available, and public exploit code exists.

Successful exploitation leads to forced session expiration, which could disrupt user sessions and potentially cause denial of service for legitimate users. The impact is limited to session management disruption without evidence of privilege escalation or data compromise. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is documented, users should monitor vendor channels for updates. Until a fix is available, consider restricting access to the affected logout endpoint or implementing compensating controls to detect and prevent unauthorized session termination attempts.