CVE-2026-26273

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26273", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-12T17:10:53.413Z", "datePublished": "2026-02-13T21:45:41.610Z", "dateUpdated": "2026-02-17T20:00:54.355Z"}, "containers": {"cna": {"title": "Known affected by Account Takeover via Password Reset Token Leakage", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-640", "lang": "en", "description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password", "type": "CWE"}]}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}}], "references": [{"name": "https://github.com/idno/known/security/advisories/GHSA-78wq-6gcv-w28r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/idno/known/security/advisories/GHSA-78wq-6gcv-w28r"}, {"name": "https://github.com/idno/known/commit/8439a0747471559fb1ea9f074b929d390f27e66a", "tags": ["x_refsource_MISC"], "url": "https://github.com/idno/known/commit/8439a0747471559fb1ea9f074b929d390f27e66a"}, {"name": "https://github.com/idno/known/releases/tag/1.6.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/idno/known/releases/tag/1.6.3"}], "affected": [{"vendor": "idno", "product": "known", "versions": [{"version": "< 1.6.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-13T21:45:41.610Z"}, "descriptions": [{"lang": "en", "value": "Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's email, leading to full Account Takeover (ATO) without requiring access to the victim's email inbox. This vulnerability is fixed in 1.6.3."}], "source": {"advisory": "GHSA-78wq-6gcv-w28r", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T20:00:43.160262Z", "id": "CVE-2026-26273", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T20:00:54.355Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26273", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-17T20:00:43.160262Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T20:00:47.600Z"}}], "cna": {"title": "Known affected by Account Takeover via Password Reset Token Leakage", "source": {"advisory": "GHSA-78wq-6gcv-w28r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_0": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "idno", "product": "known", "versions": [{"status": "affected", "version": "< 1.6.3"}]}], "references": [{"url": "https://github.com/idno/known/security/advisories/GHSA-78wq-6gcv-w28r", "name": "https://github.com/idno/known/security/advisories/GHSA-78wq-6gcv-w28r", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/idno/known/commit/8439a0747471559fb1ea9f074b929d390f27e66a", "name": "https://github.com/idno/known/commit/8439a0747471559fb1ea9f074b929d390f27e66a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/idno/known/releases/tag/1.6.3", "name": "https://github.com/idno/known/releases/tag/1.6.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's email, leading to full Account Takeover (ATO) without requiring access to the victim's email inbox. This vulnerability is fixed in 1.6.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-640", "description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-13T21:45:41.610Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26273", "state": "PUBLISHED", "dateUpdated": "2026-02-17T20:00:54.355Z", "dateReserved": "2026-02-12T17:10:53.413Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-13T21:45:41.610Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "known", "vendor": "idno", "versions": [{"status": "affected", "version": "< 1.6.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:withknown:known:*:*:*:*:*:*:*:*", "matchCriteriaId": "12596360-0063-45F0-ADAE-20BDFEA8FABA", "versionEndExcluding": "1.6.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's email, leading to full Account Takeover (ATO) without requiring access to the victim's email inbox. This vulnerability is fixed in 1.6.3."}, {"lang": "es", "value": "Known es una plataforma de publicaci\u00f3n social. Antes de 1.6.3, existe una vulnerabilidad cr\u00edtica de autenticaci\u00f3n rota en Known 1.6.2 y versiones anteriores. La aplicaci\u00f3n filtra el token de restablecimiento de contrase\u00f1a dentro de un campo de entrada HTML oculto en la p\u00e1gina de restablecimiento de contrase\u00f1a. Esto permite a cualquier atacante no autenticado recuperar el token de restablecimiento para cualquier usuario simplemente consultando el correo electr\u00f3nico del usuario, lo que lleva a una toma de control total de la cuenta (ATO) sin requerir acceso a la bandeja de entrada de correo electr\u00f3nico de la v\u00edctima. Esta vulnerabilidad est\u00e1 corregida en 1.6.3."}], "id": "CVE-2026-26273", "lastModified": "2026-06-17T10:26:01.490", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26273", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T20:00:43.160262Z", "version": "2.0.3"}}]}, "published": "2026-02-13T22:16:11.330", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/idno/known/commit/8439a0747471559fb1ea9f074b929d390f27e66a"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/idno/known/releases/tag/1.6.3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/idno/known/security/advisories/GHSA-78wq-6gcv-w28r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-640"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.6.3)"}}], "product": "known", "vendor": "idno"}], "analysis": {"en": {"generated_at": "2026-04-17T19:46:49.213243+00:00", "value": {"mitigation_remediation": ["Upgrade Known to version 1.6.3 or newer, which removes the hidden input and properly protects reset tokens.", "If an upgrade is not immediately possible, temporarily disable the password reset or password\u2011reset endpoint for all users until the patch is applied. This stops leaked tokens from being generated while the website remains functional for authenticated users.", "In the interim, restrict password reset requests to throttled or verified requests, and consider adding multi\u2011factor authentication to the reset flow to reduce the risk of unattended resets."], "summary": {"action": "Immediate Patch", "impact": "Full Account Takeover via leaked password reset token"}, "threat_synthesis": {"affected_systems": "The affected platform is the social\u2011publishing application Known, maintained by withknown. Any installation running Known 1.6.2 or earlier is susceptible. The patch that fixes the issue is released as version 1.6.3 and onward. No other vendors have been listed in the impact data.", "description_and_impact": "Prior to version 1.6.3, Known exposes password reset tokens through a hidden input field on the reset page. An attacker who can identify a target's email address can request a reset and read the token embedded in the response. With this token the attacker can reset the account password and later log in as that user. The flaw is a classic data exposure combined with credential management weakness, allowing full compromise of the account without needing access to the victim\u2019s email.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 9.8, indicating a critical severity. The EPSS score is below one percent, so the likelihood of exploitation is currently low, but the low effort and high impact mean that it remains a priority for mitigation. Known is not yet listed in the CISA KEV catalog, but the high exposure ratings call for fast action. Attackers can exploit the flaw over the public web interface, requiring only an email address for the target."}}}}, "created": "2026-02-16T12:03:24.549552+00:00", "updated": "2026-04-17T20:00:09.000603+00:00", "vendors": ["idno", "idno$PRODUCT$known"]}