CVE-2026-102115CWE-640

CVE-2026-102115

Critical · published October 1, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
63.3
In the wild
Unconfirmed
What it is

Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01026 · 63.3th percentile
Weakness
CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
Published
2026-10-01T01:16Z
Affected products (1)
ProductVersionsFixed in
accellion/kiteworks< 9.5.09.5.0
References (2)
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-q76w-qv9j-q639 · 9119a7d8-5eab-497f-8521-727c672e3725https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 1%
    epss
  • 30 SEP 20:19Z
    Kiteworks Core Authentication Bypass in the Password Reset Workflow
    cvelistv5