CVE-2026-102115: Kiteworks Core Authentication Bypass in the Password Reset Workflow
Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges.
Affected Software
Event History
Frequently Asked Questions
Which accounts are susceptible to takeover?
Accounts with locally stored passwords are susceptible if an attacker knows the account email address. Accounts using a different authentication arrangement are not identified as affected by the available information.
Does exploitation require an existing account, credentials, or user interaction?
No. The issue can be exploited by an unauthenticated attacker and does not require the emailed password-reset link; knowing the target user's email address is the stated prerequisite.
What is the potential impact if an administrative account is targeted?
An attacker could reset the administrator's password and authenticate as that administrator. This could result in full compromise of confidentiality, integrity, and availability within the affected environment.