CVE-2026-105098: CoinEx Crypto Information Disclosure Flaw

CVE-2026-105098 Overview

CVE-2026-105098 is an information disclosure vulnerability in Omega Solution CoinEx Crypto 2025. The flaw resides in the Support Ticket API, specifically within the /ticket/customer endpoint. Attackers manipulate the status, page, or count arguments to retrieve data that should not be exposed. The attack is executed remotely over the network and requires low privileges. The exploit has been publicly released, increasing the risk of opportunistic abuse. The vendor was contacted but did not respond, and the product website is no longer reachable, suggesting the product may be retired.

Critical Impact

Remote attackers with low-privilege access can enumerate ticket data by tampering with request parameters on the /ticket/customer endpoint, exposing confidential customer support information [CWE-200].

Affected Products

• Omega Solution CoinEx Crypto 2025
• Component: Support Ticket API
• Endpoint: /ticket/customer

Discovery Timeline

• 2026-10-04 - CVE-2026-105098 published to NVD
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105098

Vulnerability Analysis

The vulnerability is classified as Information Disclosure under [CWE-200]. It affects the Support Ticket API component of Omega Solution CoinEx Crypto 2025. An authenticated user issues HTTP requests to /ticket/customer and manipulates the status, page, or count parameters. The application returns ticket records that the caller should not be authorized to view. This indicates missing or improper authorization enforcement on query parameters used for filtering and pagination.

The exploit has been released publicly, which lowers the barrier for abuse. Attack complexity is low and no user interaction is required. Because the vendor website is offline and the vendor did not respond to disclosure, no official patch is expected.

Root Cause

The root cause is improper access control over data returned by the Support Ticket API. The endpoint trusts client-supplied status, page, and count values without validating that the authenticated principal is entitled to the records matching those filters. This produces a classic broken object-level authorization pattern, resulting in disclosure of ticket metadata and content.

Attack Vector

The attack vector is Network. An attacker with a low-privilege account sends crafted HTTP requests to /ticket/customer and varies status, page, and count to enumerate tickets. No special tooling or user interaction is required. See the public proof of concept at PoCVulDb Issue #26 and the VulDB entry for CVE-2026-105098 for additional technical context.

Detection Methods for CVE-2026-105098

Indicators of Compromise

• Repeated GET requests to /ticket/customer with iterating page or count values from a single session or source IP.
• Requests enumerating multiple status values in short succession, indicating parameter fuzzing.
• Anomalous volume of successful 200 responses to /ticket/customer relative to baseline user behavior.

Detection Strategies

• Deploy web application firewall rules that rate-limit and alert on parameter enumeration against /ticket/customer.
• Correlate authenticated session identifiers with the volume and diversity of ticket records returned per session.
• Hunt for low-privilege accounts accessing tickets that do not belong to their customer scope.

Monitoring Recommendations

• Enable verbose HTTP access logging for the Support Ticket API, capturing full query strings.
• Forward application and reverse-proxy logs to a centralized analytics platform for retention and query.
• Alert on sessions whose request-to-record ratio deviates significantly from established baselines.

How to Mitigate CVE-2026-105098

Immediate Actions Required

• Restrict network access to the Support Ticket API using IP allowlisting or VPN gating until a fix is available.
• Enforce server-side authorization checks that scope ticket queries to the authenticated customer identifier.
• Audit historical access logs for /ticket/customer to identify prior enumeration activity.

Patch Information

No vendor patch is available. The vendor did not respond to disclosure attempts and the product website is no longer reachable, indicating the product may be retired or replaced. Operators should plan migration to a supported alternative. Refer to the VulDB vulnerability record for ongoing status.

Workarounds

• Place the application behind a reverse proxy that enforces per-user authorization on /ticket/customer.
• Introduce request validation that rejects unexpected or out-of-range values for status, page, and count.
• Decommission the application if business requirements allow, given the lack of vendor support.

# Example NGINX rate-limit and parameter-length guard for /ticket/customer
limit_req_zone $binary_remote_addr zone=ticket_api:10m rate=10r/m;

location /ticket/customer {
    limit_req zone=ticket_api burst=5 nodelay;
    if ($args ~* "count=([0-9]{4,})") { return 400; }
    if ($args ~* "page=([0-9]{5,})")  { return 400; }
    proxy_pass http://backend;
}