CVE-2026-26273
Critical
Description
Known is a social publishing platform. Prior to 1.6.3, a Critical Broken Authentication vulnerability exists in Known 1.6.2 and earlier. The application leaks the password reset token within a hidden HTML input field on the password reset page. This allows any unauthenticated attacker to retrieve the reset token for any user by simply querying the user's email, leading to full Account Takeover (ATO) without requiring access to the victim's email inbox. This vulnerability is fixed in 1.6.3.
SeverityCritical
CVSS9.8
Exploit probability—
ProductKnown
PublishedFeb 13, 2026
First seenFeb 13, 2026
Weakness typeCWE-200Sensitive information exposureCWE-640CWE-640
How to fix
Update
- withknown known1.6.3 or later
- idno/known1.6.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| withknown known | v < 1.6.3 | 1.6.3 |
| idno/knownPackagist | v < 1.6.3 | 1.6.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.