CVE-2026-26273

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-26273

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26273.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-26273

Aliases

GHSA-78wq-6gcv-w28r

Published

2026-02-13T21:45:41.610Z

Modified

2026-03-03T02:56:12.927600Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Known affected by Account Takeover via Password Reset Token Leakage

Details

Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's email, leading to full Account Takeover (ATO) without requiring access to the victim's email inbox. This vulnerability is fixed in 1.6.3.

Database specific

{
    "cwe_ids": [
        "CWE-200",
        "CWE-640"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26273.json"
}

References

Affected packages

Git / github.com/idno/idno

Affected ranges

Type: GIT
Repo: https://github.com/idno/idno
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

8439a0747471559fb1ea9f074b929d390f27e66a

Affected versions

1.*

1.0.0

1.0.0-rc.1

1.0.0-rc.3

1.2.2

1.6.2

v0.*

v0.6

v0.6.5

v0.7

v0.7.1

v0.7.5

v0.7.6

v0.7.7

v0.7.7.1

v0.7.8

v0.7.8.5

v0.7.8.5.1

v0.8

v0.8.1

v0.8.2

v0.8.3

v0.8.3.1

v0.8.4

v0.8.5

v0.9

v0.9.0.1

v0.9.0.2

v0.9.0.3

v0.9.0.4

v0.9.1

v0.9.2

v0.9.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26273.json"

Git / github.com/idno/known