CVE-2026-105096: CoinEx Crypto Auth Bypass Vulnerability

CVE-2026-105096 Overview

CVE-2026-105096 is an authorization bypass vulnerability affecting the Customer Profile API component in Omega Solution CoinEx Crypto 2025. The flaw resides in the /customer/ endpoint and stems from improper authorization checks on the ID parameter [CWE-285]. An authenticated remote attacker can manipulate the ID argument to access or modify customer profile data belonging to other users. The exploit has been publicly disclosed. The vendor did not respond to disclosure attempts, and the product website is no longer reachable, suggesting the product may be retired.

Critical Impact
Remote authenticated attackers can bypass authorization controls on the Customer Profile API to access other users' profile data by manipulating the ID parameter in /customer/ requests.

Affected Products

Omega Solution CoinEx Crypto 2025
Component: Customer Profile API (/customer/ endpoint)
Vendor status: Unresponsive; product likely retired

Discovery Timeline

2026-10-04 - CVE-2026-105096 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105096

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) in the Customer Profile API of CoinEx Crypto 2025. The /customer/ endpoint accepts an ID parameter that identifies which customer record to return. The application fails to validate whether the authenticated session owner is authorized to access the requested ID. As a result, a low-privileged authenticated user can iterate or guess identifiers to retrieve profile data for arbitrary customers.

The weakness is classified under CWE-285: Improper Authorization. Confidentiality, integrity, and availability impacts are rated low because the exposed data is scoped to customer profile fields rather than full administrative control. The exploit is reachable over the network and requires only a valid low-privilege account.

Root Cause

The root cause is missing object-level authorization enforcement on the Customer Profile API handler. The endpoint trusts the client-supplied ID value and does not cross-check that value against the authenticated session's identity. Server-side logic should bind the returned record to the session principal rather than accept arbitrary identifiers.

Attack Vector

Exploitation proceeds over HTTP against the public application. An attacker authenticates with a standard customer account, intercepts a legitimate /customer/ request, and substitutes the ID parameter with another user's identifier. The server returns the targeted record without rejecting the request. No user interaction is required beyond initial authentication.

No verified proof-of-concept code is available in authoritative sources. Public disclosure details are tracked in the GitHub Issue #24 Discussion and the VulDB CVE-2026-105096 Report.

Detection Methods for CVE-2026-105096

Indicators of Compromise

Repeated /customer/ requests from a single session enumerating sequential or varied ID values.
HTTP 200 responses for /customer/?ID=<value> where the returned record does not match the session principal.
Anomalous volumes of customer profile reads originating from a single account within a short interval.

Detection Strategies

Correlate authenticated session identifiers with the ID parameter values returned by /customer/ responses and alert on mismatches.
Baseline normal profile-access rates per account and flag deviations consistent with enumeration behavior.
Deploy web application firewall (WAF) rules that inspect /customer/ traffic for parameter tampering patterns.

Monitoring Recommendations

Enable verbose access logging for the Customer Profile API, capturing session ID, source IP, and ID parameter values.
Forward application and WAF logs to a centralized analytics platform to support cross-session correlation.
Review audit trails for historical access patterns against the /customer/ endpoint to identify prior exploitation.

How to Mitigate CVE-2026-105096

Immediate Actions Required

Restrict external exposure of the CoinEx Crypto 2025 application behind authenticated reverse proxies or VPN until compensating controls are deployed.
Deploy WAF rules that block /customer/ requests where the ID parameter does not match the authenticated session principal.
Audit application logs for prior unauthorized profile reads and notify affected customers if evidence of access is found.

Patch Information

No vendor patch is available. The vendor did not respond to disclosure outreach, and the product website is offline. Organizations should treat the product as end-of-life and plan migration to a supported alternative. Refer to the VulDB Vulnerability #413345 record for ongoing tracking.

Workarounds

Migrate off Omega Solution CoinEx Crypto 2025 to a supported platform that enforces object-level authorization.
Introduce a reverse proxy that rewrites or validates the ID parameter against the authenticated session before forwarding to the application.
Reduce the privilege and reachability of accounts that can call /customer/, limiting the enumeration surface.

bash

# Example NGINX snippet to block /customer/ requests lacking a valid session cookie
location /customer/ {
    if ($cookie_session = "") {
        return 403;
    }
    proxy_pass http://backend;
}