CVE-2026-27637 FreeScout's Predictable Authentication Token Enables Account Takeover
Attackers can achieve full account takeover by computing predictable authentication tokens if the application key is exposed.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-27637?
CVE-2026-27637 is a critical authentication bypass vulnerability in freescout-help-desk freescout, published on 25 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206, FreeScout's `TokenAuth` middleware uses a predictable authentication token computed as `MD5(user_id + created_at + APP_KEY)`. This token is static (never expires/rotates), and if an attacker obtains the `APP_KEY` — a well-documented and common exposure vector in Laravel applications — they can compute a valid token for any user, including the administrator, achieving full account takeover without any password. This vulnerability can be exploited on its own or in combination with CVE-2026-27636. Version 1.8.206 fixes both vulnerabilities.
Weakness: CWE-330
Which versions are affected by CVE-2026-27637?
It affects 1 product.
Products include Freescout Freescout.
How do I fix CVE-2026-27637?
No fix has been published for CVE-2026-27637 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-27637 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27637 exists.
Other vulnerabilities in freescout-help-desk freescout
- CVE-2026-28289 FreeScout 1.8.206 Patch Bypass for CVE-2026-27636 via Zero-Width Space Character Leads to Remote Code Execution
- CVE-2026-32754 FreeScout: Stored XSS via Unescaped Email Template Rendering ({!! $thread->body !!})
- CVE-2024-29185 FreeScout OS Command Injection vulnerability
- CVE-2026-40498 FreeScout has Authentication Bypass and Information Disclosure in SystemController via /system/cron
- CVE-2026-40496 FreeScout has Predictable Attachment Token that Allows Unauthenticated Private File Download via Brute Force