{"id":"CVE-2026-102458","published":"2026-09-30T09:17:13.800","lastModified":"2026-09-30T16:30:42.327","description":"EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://www.twcert.org.tw/en/cp-139-11242-13f37-2.html","tags":[]},{"url":"https://www.twcert.org.tw/tw/cp-132-11237-c9189-1.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw is a missing authentication vulnerability in EasyFlow .NET, allowing unauthenticated attackers to steal plaintext passwords via a specific API. This matters because it exposes sensitive user credentials to unauthorized access.","exploitability":"Exploitation is relatively straightforward as it requires only access to the specific API endpoint without authentication. Precondition is that the API is exposed to the internet or a network segment.","blast_radius":"If exploited, the impact could be severe, as it allows attackers to gain full access to user accounts and potentially the entire system.","remediation":"Disable the affected API endpoint or restrict access to it strictly. If a fixed version is available, upgrade to the latest version as published: 'Upgrade to 2.590 or later'.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","api","plaintext","web"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-01T08:43:40.743Z"}}