https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 01:07:31 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-268753 EUVD-2026-268753 https://cve.radiocsirt.org/vuln/euvd-2026-268753 https://cve.radiocsirt.org/vuln/fkie_cve-2026-26273 <p>Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user&#39;s email, leading to full Account Takeover (ATO) without requiring access to the victim&#39;s email inbox. This vulnerability is fixed in 1.6.3.</p> <p>Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user&#39;s email, leading to full Account Takeover (ATO) without requiring access to the victim&#39;s email inbox. This vulnerability is fixed in 1.6.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-26273 https://cve.radiocsirt.org/vuln/ghsa-78wq-6gcv-w28r <p><strong>Affected:</strong> Packagist: idno/known</p> <p>### Summary A Critical Broken Authentication vulnerability exists in Known 1.6.2. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user&#39;s email, leading to full Account Takeover (ATO) without requiring access to the victim&#39;s email inbox.</p> <p>### Details The vulnerability occurs within the password reset flow. When a reset is requested, the application generates a verification code. However, the subsequent reset page (/account/password/reset/) incorrectly reflects this code back to the client in the HTML source code.</p> <p>Specifically, the sensitive token is embedded in: &lt;input type=&#34;hidden&#34; name=&#34;code&#34; value=&#34;[SECRET_TOKEN]&#34;&gt;</p> <p>Because this page is accessible via a GET request using the victim&#39;s email as a parameter, an attacker can programmatically extract the token.</p> <p>### PoC 1. The attacker asks for a password reset for the victim</p> <p>&lt;img width=&#34;1328&#34; height=&#34;580&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/0197907e-f10b-4e6d-989e-f25c408862cd&#34; /&gt;</p> <p>&lt;img width=&#34;1139&#34; height=&#34;452&#34; alt=&#34;image(1)&#34; src=&#34;https://github.com/user-attachments/assets/9a317b27-b56a-4663-9965-d3e660713f4e&#34; /&gt;</p> <p>2. The attacker makes the following curl command on the terminal using the victim&#39;s email, and is able to get the code that was sent as an hidden field in the HTML. &lt;img width=&#34;917&#34; height=&#34;220&#34; alt=&#34;image(2)&#34; src=&#34;https://gith…</p> <p><strong>Affected:</strong> Packagist: idno/known</p> <p>### Summary A Critical Broken Authentication vulnerability exists in Known 1.6.2. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user&#39;s email, leading to full Account Takeover (ATO) without requiring access to the victim&#39;s email inbox.</p> <p>### Details The vulnerability occurs within the password reset flow. When a reset is requested, the application generates a verification code. However, the subsequent reset page (/account/password/reset/) incorrectly reflects this code back to the client in the HTML source code.</p> <p>Specifically, the sensitive token is embedded in: &lt;input type=&#34;hidden&#34; name=&#34;code&#34; value=&#34;[SECRET_TOKEN]&#34;&gt;</p> <p>Because this page is accessible via a GET request using the victim&#39;s email as a parameter, an attacker can programmatically extract the token.</p> <p>### PoC 1. The attacker asks for a password reset for the victim</p> <p>&lt;img width=&#34;1328&#34; height=&#34;580&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/0197907e-f10b-4e6d-989e-f25c408862cd&#34; /&gt;</p> <p>&lt;img width=&#34;1139&#34; height=&#34;452&#34; alt=&#34;image(1)&#34; src=&#34;https://github.com/user-attachments/assets/9a317b27-b56a-4663-9965-d3e660713f4e&#34; /&gt;</p> <p>2. The attacker makes the following curl command on the terminal using the victim&#39;s email, and is able to get the code that was sent as an hidden field in the HTML. &lt;img width=&#34;917&#34; height=&#34;220&#34; alt=&#34;image(2)&#34; src=&#34;https://gith…</p> https://cve.radiocsirt.org/vuln/ghsa-78wq-6gcv-w28r