What’s Vulnerable › Vulnerabilities

CVE-2024-26136: kedi ElectronCord's Discord Token is public

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-20 · updated 2026-06-17
• Weakness: CWE-200

Description

kedi ElectronCord is a bot management tool for Discord. Commit aaaeaf4e6c99893827b2eea4dd02f755e1e24041 exposes an account access token in the `config.json` file. Malicious actors could potentially exploit this vulnerability to gain unauthorized access to sensitive information or perform malicious actions on behalf of the repository owner. As of time of publication, it is unknown whether the owner of the repository has rotated the token or taken other mitigation steps aside from informing users of the situation.

Affected products

• kedi ElectronCord: before 2024-02-19 — fixed in 2024-02-19

How to fix

Upgrade to a fixed version: kedi ElectronCord 2024-02-19. Check the vendor advisory for mitigations.

References

• https://github.com/kedi/ElectronCord/commit/aaaeaf4e6c99893827b2eea4dd02f755e1e24041
• https://github.com/kedi/ElectronCord/security/advisories/GHSA-ppwc-5vwp-mhw8
• https://github.com/kedi/ElectronCord/commit/aaaeaf4e6c99893827b2eea4dd02f755e1e24041
• https://github.com/kedi/ElectronCord/security/advisories/GHSA-ppwc-5vwp-mhw8

Get alerted when CVE-2024-26136 or the next vulnerability affects your stack