# CVE-2026-78555: RansomLook API key exposure in HTML source

Source: https://junglewise.ai/threats/cve-2026-78555-ransomlook-api-key-exposure-in-html-source  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78555 · Severity: info · CVSS 0 · Published 2026-08-24

RansomLook exposed full API keys in the HTML source code of its administrative API keys page, despite displaying only shortened versions to users. An attacker with access to the page source, browser cache, or monitoring tools could recover complete API credentials and use them to access data and services the key was authorized for. This vulnerability affected authenticated administrators and could be exploited through various intermediaries that retain HTTP response bodies.

Technologies: [RansomLook](https://junglewise.ai/threats/technologies/ransomlook). Vendors: [RansomLook](https://junglewise.ai/threats/vendors/ransomlook).

## Quick answers

**Is CVE-2026-78555 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78555 being exploited in the wild.

**How severe is CVE-2026-78555?** Informational severity, with a CVSS score of 0, published 24 August 2026.

**Which products and versions are affected?** RansomLook RansomLook.

**Is there a fix for CVE-2026-78555?** A patch was published on 2026-08-24: Patch available in commit b358dfa Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78555 attacked?** It is attacked with local access or over the network.

**Am I affected by CVE-2026-78555?** Check whether you run RansomLook. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

RansomLook embedded complete API keys in hidden form fields on the /admin/apikeys authenticated page, even though the user interface displayed only truncated representations. The full tokens were exposed in the HTML source and could be recovered through client-side inspection, cached responses, debugging proxies, or monitoring systems. An attacker with a leaked API key could authenticate with the privileges assigned to that key, potentially gaining unauthorized access to private data. The fix replaces API keys with SHA-256-derived opaque handles in rendered pages, disclosing the full key only at creation time; administrative actions use the handles which are resolved server-side.

## Affected products

- RansomLook RansomLook

## Timeline

- 2026-08-24: disclosed
- 2026-08-24: patched: Patch available in commit b358dfa

## References

- [https://github.com/RansomLook/RansomLook/commit/b358dfa4f40c677a47c602ebbb4473aeae349f5c](https://github.com/RansomLook/RansomLook/commit/b358dfa4f40c677a47c602ebbb4473aeae349f5c)

## Related threats

- [RansomLook insecure Flask session key file permissions](https://junglewise.ai/threats/cve-2026-78553-ransomlook-insecure-flask-session-key-file-permissions)
- [RansomLook authentication endpoint enumeration and DoS](https://junglewise.ai/threats/cve-2026-78551-ransomlook-authentication-endpoint-enumeration-and-dos)
- [RansomLook API information disclosure via unauthenticated location records](https://junglewise.ai/threats/cve-2026-78386-ransomlook-api-information-disclosure-via-unauthenticated)
- [RansomLook insufficient resource validation in PDF generation](https://junglewise.ai/threats/cve-2026-78385-ransomlook-insufficient-resource-validation-in-pdf-generation)
- [RansomLook Redis glob pattern injection](https://junglewise.ai/threats/cve-2026-78378-ransomlook-redis-glob-pattern-injection)