CVE-2026-26273 Details
Description
Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's email, leading to full Account Takeover (ATO) without requiring access to the victim's email inbox. This vulnerability is fixed in 1.6.3.
A critical broken authentication vulnerability has been identified in the Known social publishing platform, specifically in versions prior to 1.6.3. The issue arises because the application leaks the password reset token in a hidden HTML input field on the password reset page. This vulnerability allows any unauthenticated attacker to obtain the reset token for any user by simply querying the user's email. As a result, the attacker can reset the user's password and gain full access to the account, without needing to access the victim's email inbox.
Users can update to Known version 1.6.3, which addresses this vulnerability by removing the token from the password reset page and implementing proper validation for password reset requests.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/idno/known/commit/8439a0747471559fb1ea9f074b929d390f27e66a | [email protected] | Patch |
| https://github.com/idno/known/releases/tag/1.6.3 | [email protected] | ProductRelease Notes |
| https://github.com/idno/known/security/advisories/GHSA-78wq-6gcv-w28r | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-640 | Weak Password Recovery Mechanism for Forgotten Password | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| withknown known | < 1.6.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 18, 2026 | Initial Analysis | [email protected] |
| Feb 13, 2026 | New CVE Received | [email protected] |