← Vulnerability feed

Vulnerability record · CVE-2026-26273 · published 13 February 2026

CVE-2026-26273: Withknown known information exposure vulnerability

Withknown · Known

Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's email, leading to full Account Takeover (ATO) without requiring access to the victim's email inbox. This vulnerability is fixed in 1.6.3.

9.8 CVSS 3.0 Critical EPSS 1.2% · top 34.2% CWE-200 · Information exposureCWE-640 · Weak password recovery
9.8CVSS 3.0 base score
1.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's email, leading to full Account Takeover (ATO) without requiring access to the victim's email inbox. This vulnerability is fixed in 1.6.3.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/idno/known/commit/8439a0747471559fb1ea9f074b929d390f27e66a Patch
https://github.com/idno/known/releases/tag/1.6.3 ProductRelease Notes
https://github.com/idno/known/security/advisories/GHSA-78wq-6gcv-w28r ExploitVendor Advisory

Track CVE-2026-26273 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.2CVE-2026-28508Withknown known server-side request forgery (ssrf) vulnerabilityIdno is a social publishing platform. Prior to version 1.6.4, a logic error in the API authentication flow causes the CSRF protection on the URL unfu…EPSS 0.72%8.8CVE-2022-33011Withknown known injection vulnerabilityKnown v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover via a host header injection attack.EPSS 1.5%8.6CVE-2026-28507Withknown known os command injection vulnerabilityIdno is a social publishing platform. Prior to version 1.6.4, there is a remote code execution vulnerability via chained import file write and templa…EPSS 0.92%6.1CVE-2022-32115Withknown known cross-site scripting vulnerabilityAn issue in the isSVG() function of Known v1.2.2+2020061101 allows attackers to execute arbitrary code via a crafted SVG file.EPSS 1.4%5.4CVE-2022-31290Withknown known cross-site scripting vulnerabilityA cross-site scripting (XSS) vulnerability in Known v1.2.2+2020061101 allows authenticated attackers to execute arbitrary web scripts or HTML via a c…EPSS 0.86%4.3CVE-2022-30852Withknown known insecure direct object reference vulnerabilityKnown v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR).EPSS 0.95%5.9CVE-2025-68686FortiOS symbolic link patch bypass exposes sensitive informationFortiOS contains an information exposure flaw (CWE-200) that lets a remote unauthenticated attacker bypass the patch for the symbolic link persistenc…KEVEPSS 30%analysed7.5CVE-2026-20133Cisco Catalyst SD-WAN Manager insufficient file system restrictions expose dataCisco Catalyst SD-WAN Software has insufficient file system restrictions that let an attacker read sensitive files on the underlying operating system…KEVEPSS 32%analysed

Source: NIST National Vulnerability Database (record CVE-2026-26273), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.