PT-2026-8041 · Known · Known

Iamleandrooooo · Published 2026-02-13 · Updated 2026-02-18 · CVE-2026-26273

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Known versions prior to 1.6.3 Known version 1.6.2

Description A critical broken authentication issue exists in Known. The application reveals the password reset token within a hidden HTML input field on the password reset page. This allows an unauthenticated attacker to obtain the reset token for any user by querying the user's email, leading to full Account Takeover (ATO) without needing access to the victim's email inbox. The vulnerable page is accessible via a GET request using the victim’s email as a parameter. The sensitive token is embedded in an HTML input field with the name 'code'. The attacker can programmatically extract the token using a tool like curl. This allows the attacker to reset the victim's password and gain access to the account. This issue can lead to a total loss of Confidentiality, Integrity, and Availability, including the compromise of administrative accounts.

Recommendations Update to version 1.6.3 or later to resolve this issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-640

CWE-200

Related Identifiers

CVE-2026-26273

GHSA-78WQ-6GCV-W28R

Affected Products

Known

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26273.json · Exploit
• https://github.com/idno/known/security/advisories/GHSA-78wq-6gcv-w28r · Vendor Advisory
• https://github.com/idno/known/commit/8439a0747471559fb1ea9f074b929d390f27e66a · Patch
• https://osv.dev/vulnerability/GHSA-78wq-6gcv-w28r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26273 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26273 · Security Note
• https://github.com/idno/known · Note
• https://github.com/idno/known/releases/tag/1.6.3 · Note
• https://twitter.com/0dayPublishing/status/2023156542795665414 · Twitter Post
• https://t.me/cveNotify/152432 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1r6af6d/resumen_diario_de_vulnerabilidades_16022026 · Reddit Post
• https://twitter.com/_cvereports/status/2022448313526608048 · Twitter Post
• https://twitter.com/TheHackerWire/status/2022434785466159559 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2022504579435278353 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1r6af72/resumen_diario_de_vulnerabilidades_16022026 · Reddit Post