{"id":"CVE-2026-103098","published":"2026-10-02T01:16:43.193","lastModified":"2026-10-02T19:16:39.350","description":"Transmission of a sensitive key in the URL\nover an unencrypted HTTP connection.  The\nrequest is sent over HTTP rather than HTTPS, meaning the key is transmitted in\nplaintext across the network. An attacker with the ability to monitor network\ntraffic could intercept the request and obtain the key","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-319"],"vendors":[],"products":[],"references":[{"url":"https://www.geovision.com.tw/cyber_security.php","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows sensitive keys to be transmitted in plaintext over unencrypted HTTP connections, making them vulnerable to interception by network monitoring attackers. This creates a significant risk of credential exposure and potential unauthorized access.","exploitability":"Exploitation is relatively straightforward for network-monitoring attackers who can intercept HTTP traffic, requiring no privileged access or complex payloads.","blast_radius":"The impact could be substantial across all systems that transmit sensitive keys over HTTP, potentially exposing authentication tokens, API keys, or session identifiers to attackers.","remediation":"Upgrade to version 2.590 or later to address the insecure transmission of sensitive keys over HTTP connections.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","credential-exposure","network-traffic"],"model":"garnet-coder","analyzedAt":"2026-10-12T09:04:54.510Z"}}