CVE-2026-26273

The password reset page in the Known application embeds the reset token directly in a hidden HTML form field that is publicly accessible. An attacker, knowing the victim's email address, can send a password reset request and then read the token directly from the page source code without needing to intercept the email message. With the token, the attacker can set a new password and gain full control over the victim's account (Account Takeover, ATO).

An attacker gains full control over any user account on the platform, including access to published content, personal data, and the ability to act on behalf of the victim. The exploit requires no authentication or interaction from the victim.

Known should be updated immediately to version 1.6.3, in which the vulnerability has been fixed. The patch is available in the vendor's GitHub repository (tag 1.6.3, commit 8439a07). Until the update is applied, it is recommended to restrict access to the password reset page or temporarily disable this functionality.

Known (social platform) in versions 1.6.2 and earlier (product: Withknown Known).