CVE-2026-102115 — Kiteworks Core Authentication Bypass in the Password Reset Workflow
Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally s…
Published: 2026-09-30 · CVSS: 9.8 · CVSS 3.1
Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7