External risk intelligence

RansomLook API Keys Exposed in Admin Page Source Code

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-78555

The vulnerability exists within an authenticated administration interface (/admin/apikeys). While the product may be network-reachable, administrative panels are typically restricted to internal access or protected by secondary controls, making direct exposure to the public internet uncommon in standard deployments.

Information Disclosure

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves an application that inadvertently exposed complete API keys within the source code of its administrative interface. While the visible interface only showed partial keys, the full credentials were embedded and accessible by inspecting the page's underlying code. An attacker gaining access to these credentials could authenticate with the same permissions as the compromised key, potentially accessing private data.

Full API keys were exposed in hidden code.
Matters if sensitive data is accessible via API keys.
Confirm if administrative access leads to data exposure.

Attack Path

How an attacker could exploit the issue

An attacker with administrative access could expose complete API keys by inspecting the HTML source of the `/admin/apikeys` page. This allows them to steal credentials, which can then be used to authenticate with the system and access private data.

Requires administrative access.
Triggered by viewing the API keys page.
Risk of unauthorized data access.

Live Threat

Current exploitation, exposure, and threat context

Realistic Threat

When an attacker gains access to the authenticated `/admin/apikeys` page, they could recover full API keys embedded in the HTML source. This exposure could occur through direct inspection of the page source or via intermediaries that retain HTTP response bodies. An attacker who obtains these keys could authenticate with the associated privileges, potentially accessing private data.

Full API keys could be exposed.
Keys may be found in page source or caches.
Affected keys grant access to private data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The application owner is responsible for identifying where the affected administration page is deployed and confirming its reachability and business criticality. Coordination with the security team for exposure review and remediation planning, considering vendor involvement if applicable, is the crucial first step.

App owners must identify affected instances.
Verify reachability and business criticality.
Plan remediation based on risk exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is RansomLook?

RansomLook is a software application designed to help users track and monitor ransomware activity. It includes an administration interface, specifically the /admin/apikeys page, which manages API credentials that allow the software to interact with external services or protected data sources.

What does CWE-200 and CWE-522 mean for CVE-2026-78555?

These codes identify the vulnerability as an information exposure (CWE-200) involving insufficiently protected credentials (CWE-522). In this case, the application inadvertently included complete, plaintext API tokens within the background HTML code of an admin page, even though the user interface only displayed a shortened, masked version of those same keys.

How can an attacker trigger this vulnerability?

An attacker must first gain authenticated access to the /admin/apikeys page. Once inside, they can trigger the vulnerability by simply viewing the HTML source code or DOM of the page. Notably, the bug does not require any specialized exploitation tools; it also persists in logs or caches that store HTTP responses, meaning the keys could be recovered by anyone with access to such intermediate systems.

Is my RansomLook instance at risk?

According to Halo Surface Signal, this vulnerability is classified as unlikely to be directly exposed to the public internet because it resides within a restricted administration panel. You should assess your own deployment to verify if this interface is limited to internal users or protected by additional layers of access control, which may mitigate the likelihood of unauthorized inspection.

How should I respond to this vulnerability?

The primary step is to identify all instances of the software and confirm their administrative access controls. Ensure that access to the management console is strictly limited to authorized personnel. Coordinate with your security team to review the potential impact of exposed keys and plan for the required software update, which moves credential management to a safer, opaque handle-based system.

References

github.com/RansomLook/RansomLook/commit/b358dfa4f40c677a47c602eb…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.