CVE-2024-26136 HIGH

CVE-2024-26136: kedi ElectronCord's Discord Token is public

Vendor Kedi
Product ElectronCord
Weakness CWE-200 · Info exposure
Published February 20, 2024
Last update August 28, 2024

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

kedi ElectronCord is a bot management tool for Discord. Commit aaaeaf4e6c99893827b2eea4dd02f755e1e24041 exposes an account access token in the `config.json` file. Malicious actors could potentially exploit this vulnerability to gain unauthorized access to sensitive information or perform malicious actions on behalf of the repository owner. As of time of publication, it is unknown whether the owner of the repository has rotated the token or taken other mitigation steps aside from informing users of the situation.

Key dates

02Disclosure timeline

February 20, 2024 CVE published
August 28, 2024 Record updated