CVE-2026-102458: DigiWin｜EasyFlow .NET - Missing Authentication
Published Sep 30, 2026
·Updated
EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API.
Affected Software
1 affected component
Digiwin EasyFlow .NET
Event History
Sep 30, 2026
CVE Published
via MITRE·08:34 AM
Data Sourced
via MITRE·08:34 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·09:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The vulnerability can be exploited remotely without authentication, privileges, or user interaction. An attacker must be able to reach the affected EasyFlow .NET API.
2
What information can be exposed?
An unauthenticated remote attacker can obtain other users' passwords in plaintext through a specific API.
3
How severe is the impact?
The issue is rated critical with a CVSS score of 9.8. Its vector indicates network reachability, low attack complexity, no required privileges or user interaction, and high confidentiality, integrity, and availability impact.