A critical vulnerability identified as CVE-2026-84115 affects Cleo Harmony versions through 5.8.1.10, with the weakness tied to the platform’s JWT Refresh Token Handler and the /api/connections endpoint.  

MITRE documented the issue on September 1, 2026, while VulDB classified it as a serious privilege-management vulnerability with a CVSS score of 8.3. 
CVE-2026-84115 Targets JWT Refresh Token Handler 
According to the vulnerability analysis, CVE-2026-84115 involves an unknown function within the JWT Refresh Token Handler component. The affected functionality processes requests sent to /api/connections, where manipulation of the Bearer argument in HTTP authorization headers can lead to impr...