CVE-2026-27637: FreeScout Predictable Authentication Token Enables Account Takeover

Overview

FreeScout is a help desk and shared inbox built on the PHP Laravel framework. According to the record, its TokenAuth middleware relies on a predictable authentication token derived from a user identifier, the account creation time and the application key. Because the token is static and does not rotate, the weakness is classified as CWE-330 (Use of Insufficiently Random Values).

Impact

If the application key is known to a third party, that party could forge valid tokens for any account, including administrators, without knowing the password.
The record assigns a CVSS base score of 9.8 (critical), and its vector indicates high impact on confidentiality, integrity and availability.
The description says the flaw can be used alone or combined with CVE-2026-27636, which is not described in this record.

Affected products and versions

Freescout Freescout: before 1.8.206.
Freescout-help-desk Freescout: before 1.8.206.
Fixed in: 1.8.206.

Exploitation status

The CISA KEV catalog does not list this CVE according to the record. No confirmed active exploitation appears in the sources consulted. The record gives an SSVC exploitation value of poc, which indicates that proof-of-concept material may exist, but it does not show observed attacks. One advisory reference is tagged as exploit-related, but the record does not describe its content. The EPSS probability is 0.00939 with a percentile of 0.60563.

Remediation and mitigation

Upgrade FreeScout to version 1.8.206 or later, which the record states fixes both related vulnerabilities.
Review the fix commit referenced by the vendor to confirm the change matches your deployment.
If there is any chance the application key was exposed, plan to rotate APP_KEY after upgrading. This is an inference from the design of the flaw, and rotating the key will also invalidate existing sessions and encrypted data that depends on it.
Restrict access to environment and configuration files and to backups that contain the application key.

Detection guidance

Review administrator and user accounts for logins, password changes or actions the account owner did not expect.
Check web server and application logs for authenticated requests from unfamiliar sources or unusual access patterns.
Verify that the installed version is 1.8.206 or later across all instances, including forks or copies that may not be tracked centrally.

Limitations of the available information

The record does not describe CVE-2026-27636, so its contribution to a combined attack cannot be assessed here. The vendor advisory and fix commit were referenced but their full contents were not analyzed for this summary. The record does not say whether any public exploit is available beyond the SSVC value and the tagged reference, and it does not provide data on how many installations are exposed.

Frequently asked questions

Which FreeScout versions are affected?

According to the record, the affected products are listed as versions before 1.8.206. Version 1.8.206 is the fixed version.

Can an attacker take over an account without a password?

The record states that if the application key is obtained, a valid token can be produced for any user, which would allow account takeover without the password. This depends on the key being exposed.

Is this vulnerability being actively exploited?

The record does not list it in CISA KEV, and no confirmed active exploitation appears in the sources consulted. The record does show an SSVC exploitation value of poc.

What should administrators do first?

Upgrade to version 1.8.206 or later. If the application key may have been exposed, plan to rotate it and review accounts for unexpected activity.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.