CVE-2026-102134: Kiteworks Core Unprotected Alternate Channel
Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, including enforcement of signed-out and revoked sessions, were not applied.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be authenticated through Kiteworks Core's central authentication service. The CVSS vector indicates the issue can be exploited over the network with low attack complexity and does not require user interaction.
What security controls may be bypassed through the affected request path?
Gateway-level API security controls were not applied on every centrally authenticated request path. This specifically includes enforcement intended to prevent use of signed-out or revoked sessions.