CVE-2026-26273 | Known is a social publishing platform. Prior to 1.6.3, a Cri… | CVSS 9.8 CRITICAL

Description

Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's email, leading to full Account Takeover (ATO) without requiring access to the victim's email inbox. This vulnerability is fixed in 1.6.3.

Metadata

CVE ID: CVE-2026-26273
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-02-12 17:10 UTC
Published: 2026-02-13 21:45 UTC
Last updated: 2026-02-17 20:00 UTC
Primary CWE: CWE-200
CWE-200: Exposure of Sensitive Information to an Unauthorize…
Vendor / Product: idno / known
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.0

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
idno	known	—	< 1.6.3

Weakness (CWE)

CWE	Source	Description
CWE-200	cna	CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-640	cna	CWE-640: Weak Password Recovery Mechanism for Forgotten Password

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (3)

https://github.com/idno/known/security/advisories/GHSA-78wq-6gcv-w28r https://github.com/idno/known/security/advisories/GHSA-78wq-6gcv-w28r
https://github.com/idno/known/commit/8439a0747471559fb1ea9f074b929d390f27e66a https://github.com/idno/known/commit/8439a0747471559fb1ea9f074b929d390f27e66a
https://github.com/idno/known/releases/tag/1.6.3 https://github.com/idno/known/releases/tag/1.6.3