{"answers":{"affected":"2 open source packages ship an affected version, including idno/known. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-26273 exists.","fix":"Upgrade idno/known to 1.6.3 or later.","what":"CVE-2026-26273 is a critical vulnerability in idno known, published on 13 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-26273 and fix it if it is affected.\n\nWhat it is: CVE-2026-26273 is a critical vulnerability in idno known, published on 13 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-26273 exists.\n\nAffected packages and fixed versions:\n- idno/known (Packagist): affected all versions; fixed in 1.6.3\n- idno/known (Packagist): affected all versions; fixed in 1.6.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-26273/ (Markdown: https://insights.sbomify.com/CVE-2026-26273/index.md)","id":"CVE-2026-26273","markdown":"https://insights.sbomify.com/CVE-2026-26273/index.md","name":"CVE-2026-26273","record":{"aliases":["GHSA-78wq-6gcv-w28r"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["account_takeover","data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Known social platform","requires_auth":"none","summary":"Attackers can steal password reset tokens from hidden HTML fields to take over any user account without email access.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"known","vendor":"withknown"}],"cvss":{"score":9.8,"severity":"critical","source":"cna","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"cwes":[{"id":"CWE-640","name":"Weak Password Recovery Mechanism for Forgotten Password"},{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"description":"Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's email, leading to full Account Takeover (ATO) without requiring access to the victim's email inbox. This vulnerability is fixed in 1.6.3.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Known affected by Account Takeover via Password Reset Token Leakage","id":"CVE-2026-26273","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":2,"n_references":3,"next":{"headline":"October: Safe Mode Bypass via Twig Database Write Operations","id":"CVE-2026-26274"},"packages":[{"ecosystem":"Packagist","fixed":["1.6.3"],"introduced":["0"],"last_affected":[],"package":"idno/known","purl":null,"source":"GHSA-78wq-6gcv-w28r"},{"ecosystem":"Packagist","fixed":["1.6.3"],"introduced":["0"],"last_affected":[],"package":"idno/known","purl":"pkg:composer/idno/known","source":"GHSA-78wq-6gcv-w28r"}],"prev":{"headline":"HomeBox affected by Stored XSS via HTML/SVG Attachment Upload","id":"CVE-2026-26272"},"products":["known"],"published":"2026-02-13","related":[{"cvss_score":9.2,"headline":"Idno: Unauthenticated SSRF via URL Unfurl Endpoint","id":"CVE-2026-28508","kev_date_added":null,"published":"2026-03-06"},{"cvss_score":8.8,"headline":"Known vulnerable to account takeover via host header injection attack in v1.3.1","id":"CVE-2022-33011","kev_date_added":null,"published":"2022-07-08"},{"cvss_score":8.6,"headline":"Idno: Remote Code Execution via Chained Import File Write and Template Path Traversal","id":"CVE-2026-28507","kev_date_added":null,"published":"2026-03-06"},{"cvss_score":6.1,"headline":"Known vulnerable to code execution via SVG file in v1.3.1","id":"CVE-2022-32115","kev_date_added":null,"published":"2022-07-08"},{"cvss_score":5.4,"headline":"Known v1.3.1 Cross-site Scripting","id":"CVE-2022-31290","kev_date_added":null,"published":"2022-07-08"},{"cvss_score":4.3,"headline":"Known v1.3.1 contains Insecure Direct Object Reference","id":"CVE-2022-30852","kev_date_added":null,"published":"2022-07-08"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-02-17","vendors":["idno"]},"summary":"Attackers can steal password reset tokens from hidden HTML fields to take over any user account without email access.","url":"https://insights.sbomify.com/CVE-2026-26273/"}