CVE-2026-78555

Name of the Vulnerable Software and Affected Versions RansomLook (affected versions not specified)

Description The authenticated /admin/apikeys administration page exposes complete API keys within the HTML source. While the user interface shows only a shortened version of the key, the full token is embedded in hidden form fields used for enable/disable, private-access, and delete actions. This allows API credentials to be recovered by inspecting the page source or Document Object Model (DOM). Additionally, these credentials may be exposed through browser caches, debugging proxies, monitoring systems, or other intermediaries that inspect HTTP response bodies. An attacker with access to these tokens can authenticate with the privileges assigned to the key, potentially gaining access to private data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.