Read the docs
TI-2026-21243 Aliases CVE-2026-26273GHSA-78wq-6gcv-w28r

Known affected by Account Takeover via Password Reset Token Leakage

Priority HIGH 82CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-640.

Summary

Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's email, leading to full Account Takeover (ATO) without requiring access to the victim's email inbox. This vulnerability is fixed in 1.6.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00972 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed known (idno): 1.6.3idno/known (Packagist): 1.6.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
idnoknownbefore 1.6.31.6.3Patch availableCNA
—idno/known (Packagist)before 1.6.31.6.3Patch availableGHSA-78wq-6gcv-w28r
  • known Vendoridno Affected before 1.6.3 Fixed in 1.6.3 Patch available CNA
  • idno/known (Packagist) Vendor— Affected before 1.6.3 Fixed in 1.6.3 Patch available GHSA-78wq-6gcv-w28r

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:withknown:known:*:*:*:*:*:*:*:*before 1.6.3Vulnerableidno
  • cpe:2.3:a:withknown:known:*:*:*:*:*:*:*:* Versions before 1.6.3 Vulnerable ·idno

Remediation

  • Fix · CNA known (idno) Fixed in 1.6.3
  • Fix · GHSA-78wq-6gcv-w28r idno/known (Packagist) Fixed in 1.6.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-26273
  2. 2026-10-03 Alias added: GHSA-78wq-6gcv-w28r

References

Exploit 1

Patch 1

Other 2

  • TI-2026-22770 Idno: Unauthenticated SSRF via URL Unfurl Endpoint CVSS 4.0CRITICAL 9.2
  • TI-2026-22769 Idno: Remote Code Execution via Chained Import File Write and Template Path Traversal CVSS 4.0HIGH 8.6
  • TI-2022-14517 Known v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover… CVSS 3.1HIGH 8.8
  • TI-2022-13859 An issue in the isSVG() function of Known v1.2.2+2020061101 allows attackers to execute… CVSS 3.1MEDIUM 6.1
  • TI-2022-13308 A cross-site scripting (XSS) vulnerability in Known v1.2.2+2020061101 allows… CVSS 3.1MEDIUM 5.4
  • TI-2022-12959 Known v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR). CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences