9.8

CVSS Score

3.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26273

CVE-2026-26273: Known affected by Account Takeover via Password Reset Token Leakage

Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's email, leading to full Account Takeover (ATO) without requiring access to the victim's email inbox. This vulnerability is fixed in 1.6.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26273

CVE-2026-26273:

9.8

CVSS Score

3.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
idno/known	composer	<= 1.6.2	1.6.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The core of the vulnerability lies in the password reset process, specifically within the Idno\Pages\Account\Password\Reset class. The getContent() method was responsible for a critical information leak. It would fetch the secret password reset token directly from the database and embed it within a hidden input field on the password reset page. This meant that any attacker could request a password reset for a victim and then simply view the HTML source of the reset page to steal the token.

The postContent() method in the same class compounded the issue. It failed to properly validate the token provided by the user. Instead of comparing the user's token with the stored one, it would fetch the stored token and proceed if one existed, effectively bypassing the check. This allowed an attacker, armed with the leaked token, to set a new password for the account, leading to a full account takeover.

A secondary, less severe vulnerability was also addressed in the same patch within Idno\Pages\Account\Password::postContent(). This function's behavior differed based on whether a requested email existed, allowing attackers to confirm valid user accounts (user enumeration). The patch remediated these issues by introducing timing-safe token comparison (hash_equals) and ensuring the sensitive token is never exposed to the client. It also standardized the response for password reset requests to prevent user enumeration.

Vulnerable functions

Idno\Pages\Account\Password\Reset::getContent

Idno/Pages/Account/Password/Reset.php

This function retrieves the actual password recovery token from the database and embeds it into a hidden field in the HTML of the password reset page. An unauthenticated attacker can request this page for any user and extract the token from the response, allowing them to reset the user's password.

Idno\Pages\Account\Password\Reset::postContent

Idno/Pages/Account/Password/Reset.php

This function incorrectly validates the password reset token. Instead of comparing the user-supplied token with the one in the database, it fetches the database token and checks if it exists. This allows an attacker who has obtained the token (via the `getContent` vulnerability) to change any user's password without proper validation.

Idno\Pages\Account\Password::postContent

Idno/Pages/Account/Password.php

This function, which handles the initial password reset request, provides a different response depending on whether the provided email address exists in the database. This allows an attacker to enumerate valid user email addresses on the platform, which is an information disclosure vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.