CVE-2026-105099: CoinEx Crypto XSS Vulnerability

CVE-2026-105099 Overview

CVE-2026-105099 is a cross-site scripting (XSS) vulnerability [CWE-79] in Omega Solution CoinEx Crypto 2025. The flaw resides in the Ticket Attachment Upload component accessed through the /user/ticket endpoint. Authenticated attackers can inject script payloads that execute in the browser context of users who interact with the affected ticket interface. A public proof-of-concept exploit has been published, and the vendor did not respond to disclosure attempts. The product website no longer exists, suggesting the application may be retired or replaced without a formal patch.

Critical Impact

Remote attackers with low privileges can inject persistent scripts through ticket attachments, enabling session abuse and client-side payload execution against other users of the application.

Affected Products

• Omega Solution CoinEx Crypto 2025
• Ticket Attachment Upload component (/user/ticket)
• Deployments where the product remains in production despite apparent vendor retirement

Discovery Timeline

• 2026-10-04 - CVE-2026-105099 published to NVD
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105099

Vulnerability Analysis

The vulnerability is a cross-site scripting flaw affecting the /user/ticket endpoint of CoinEx Crypto 2025. The Ticket Attachment Upload functionality fails to properly sanitize or encode user-controlled input before rendering it in server responses. An authenticated user with low privileges can submit crafted content through the attachment workflow. When another user views the ticket, the browser interprets the injected content as executable script. The attack is remote and requires user interaction to trigger payload execution. Exploitation does not yield server-side code execution or data confidentiality impact, but it enables actions in the victim's authenticated session context.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The ticket attachment handler accepts user-supplied values and reflects or stores them without applying output encoding or content-type validation. See the VulDB vulnerability information for additional technical context on the affected code path.

Attack Vector

An attacker authenticates to the application, navigates to the ticket module, and submits an attachment or associated metadata containing an XSS payload. The payload persists in the ticket thread. When a support agent or another user opens the ticket, the script executes under the victim's origin. The attacker can perform session riding, phishing overlays, or token theft within the application boundary. A public proof-of-concept is available in the GitHub PoC repository.

No verified exploit code is reproduced here. Refer to the linked proof-of-concept for payload specifics and reproduction steps.

Detection Methods for CVE-2026-105099

Indicators of Compromise

• HTTP POST requests to /user/ticket containing <script>, onerror=, onload=, or javascript: strings in form fields or filenames
• Stored ticket records whose attachment filenames or descriptions contain HTML tags or JavaScript event handlers
• Unexpected outbound requests from support agent browsers immediately after opening a ticket

Detection Strategies

• Inspect web server access logs for ticket submissions containing encoded or raw HTML characters in attachment parameters
• Deploy a web application firewall rule matching XSS payload patterns targeting the /user/ticket path
• Review database records in ticket tables for stored content containing script tags or event handler attributes

Monitoring Recommendations

• Alert on anomalous JavaScript execution originating from the CoinEx Crypto 2025 application domain in browser telemetry
• Monitor session token usage patterns for support users for signs of concurrent sessions or unusual geolocation
• Correlate ticket view events with outbound HTTP requests to external hosts from the same user session

How to Mitigate CVE-2026-105099

Immediate Actions Required

• Restrict access to the /user/ticket endpoint to trusted internal users where possible
• Disable the ticket attachment upload feature if the application is no longer business-critical
• Plan migration to a supported ticketing solution given the apparent vendor retirement

Patch Information

No vendor patch is available. The vendor did not respond to the disclosure, and the product website is offline, suggesting the product has been retired or replaced. Organizations running Omega Solution CoinEx Crypto 2025 should treat it as end-of-life and plan replacement. Consult the VulDB CVE details for ongoing updates.

Workarounds

• Place the application behind a reverse proxy that strips or encodes HTML characters in request parameters sent to /user/ticket
• Enforce a strict Content Security Policy (CSP) header disallowing inline scripts and restricting script sources to trusted origins
• Configure the ticket workflow to render attachments as downloads rather than inline content, preventing browser-side script execution
• Require administrative review before user-submitted ticket content is displayed to support agents

# Example reverse proxy header injection to add CSP for the ticket path
# nginx configuration snippet
location /user/ticket {
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'";
    add_header X-Content-Type-Options "nosniff";
    add_header X-XSS-Protection "1; mode=block";
    proxy_pass http://backend;
}