Kiteworks Core: Authentication bypass in password reset workflow

Summary

Kiteworks Core does not correctly validate a parameter in the password reset workflow. An unauthenticated remote attacker who knows the email address of a user with a locally stored password can reset that password without the emailed reset link and then log in as that user, including administrators. CVSS 9.8 (critical); the vendor reports no known exploitation.

Affected

• Kiteworks Core versions prior to 9.5.0 (per the vendor advisory GHSA-q76w-qv9j-q639)
• Only accounts with a locally stored password are described as affected.

Fixed in

• Upgrade to Kiteworks Core 9.5.0 or later (patched version per vendor advisory).
• Vendor notice names 9.5.1 as the current release; target 9.5.1. Exact patch build numbers unknown.

Workaround

• No vendor workaround known. Upgrading is the only fix shown in the vendor advisory.
• Limit exposure of valid user email addresses and monitor password reset activity.

Exploitation

• Not listed in CISA KEV.
• No confirmed exploitation known; the vendor reports no indication of compromise.
• No public proof of concept found; this is not a conclusive absence.

Our recommendation

• Upgrade all Kiteworks Core instances to 9.5.1 (minimum 9.5.0) as a priority, especially internet-facing systems.
• Check for unexplained password resets, particularly on administrator accounts, and review audit logs.
• Enforce multi-factor authentication for all accounts, administrators first, and verify with the vendor whether MFA or SSO-based accounts are affected.
• Restrict exposure of the management interface where possible.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-q76w-qv9j-q639 github.com
• CISA CSAF va-26-274-01 raw.githubusercontent.com
• Kiteworks precautionary shutdown advisory www.kiteworks.com
• Securityonline: Kiteworks vulnerabilities securityonline.info
• VulDB entry 412447 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:46.