{"id":"CVE-2026-78555","state":"PUBLISHED","title":"RansomLook API Key Disclosure Through /admin/apikeys HTML Source","description":"RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete actions.\n\n\nAs a result, API credentials could be recovered by inspecting the page source or DOM. The credentials could also be unintentionally exposed through components that retain or inspect HTTP response bodies, such as debugging proxies, browser caches, monitoring systems, or other intermediaries. An attacker obtaining one of these tokens could subsequently authenticate using the privileges assigned to that key, including access to private data where the key was granted such permissions.\n\n\nThe patch removes API keys from subsequent page rendering and replaces them with SHA-256-derived opaque handles. Administrative actions submit only these handles, which are resolved back to the corresponding token on the server. The full API key is therefore disclosed only once, when it is initially created.","publishedAt":"2026-08-24T19:38:50.437Z","updatedAt":"2026-08-24T20:05:50.104Z","severity":{"score":9.4,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","source":"CIRCL"},"assigner":"CIRCL","products":["ransomlook ransomlook"],"affected":[{"vendor":"ransomlook","product":"ransomlook","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.0.0","versionType":"patch"}],"repo":"https://github.com/RansomLook/RansomLook/"}],"references":["https://github.com/RansomLook/RansomLook/commit/b358dfa4f40c677a47c602ebbb4473aeae349f5c"],"weaknesses":["CWE-522","CWE-200"],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/78xxx/CVE-2026-78555.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-78555","state":"PUBLISHED","datePublished":"2026-08-24T19:38:50.437Z","dateUpdated":"2026-08-24T20:05:50.104Z","assignerShortName":"CIRCL","assignerOrgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","dateReserved":"2026-08-24T19:38:46.389Z"},"containers":{"cna":{"title":"RansomLook API Key Disclosure Through /admin/apikeys HTML Source","descriptions":[{"lang":"en","value":"RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete actions.\n\n\nAs a result, API credentials could be recovered by inspecting the page source or DOM. The credentials could also be unintentionally exposed through components that retain or inspect HTTP response bodies, such as debugging proxies, browser caches, monitoring systems, or other intermediaries. An attacker obtaining one of these tokens could subsequently authenticate using the privileges assigned to that key, including access to private data where the key was granted such permissions.\n\n\nThe patch removes API keys from subsequent page rendering and replaces them with SHA-256-derived opaque handles. Administrative actions submit only these handles, which are resolved back to the corresponding token on the server. The full API key is therefore disclosed only once, when it is initially created."}],"affected":[{"vendor":"ransomlook","product":"ransomlook","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.0.0","versionType":"patch"}],"repo":"https://github.com/RansomLook/RansomLook/"}],"references":[{"url":"https://github.com/RansomLook/RansomLook/commit/b358dfa4f40c677a47c602ebbb4473aeae349f5c","tags":["patch"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.4,"baseSeverity":"CRITICAL","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-522","description":"CWE-522 Insufficiently Protected Credentials","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CIRCL","orgId":"5a6e4751-2f3f-4070-9419-94fb35b644e8","dateUpdated":"2026-08-24T19:51:35.236Z"},"credits":[{"lang":"en","type":"finder","value":"Jeroen Pinoy"},{"lang":"en","type":"remediation developer","value":"Fafner [_KeyZee_]"}],"impacts":[{"capecId":"CAPEC-116","descriptions":[{"lang":"en","value":"CAPEC-116 Excavation"}]},{"capecId":"CAPEC-545","descriptions":[{"lang":"en","value":"CAPEC-545 Pull Data from System Resources"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-24T20:05:27.595241Z","id":"CVE-2026-78555","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-24T20:05:50.104Z"}}]}}}