CVE-2026-102458
Received Received - Intake

Missing Authentication in EasyFlow .NET Exposes Plaintext Passwords

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: TWCERT/CC

Description
EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-102458
EUVD
EUVD-2026-89714

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
digiwin easyflow *-*

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

EasyFlow .NET by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can exploit a specific API to retrieve other users' plaintext passwords.

Detection Guidance

This vulnerability involves missing authentication in EasyFlow .NET allowing unauthenticated attackers to obtain plaintext passwords via a specific API. Detection requires checking for unauthenticated access to the vulnerable API endpoint. Inspect network traffic for requests to the API without proper authentication headers or tokens. Review server logs for unusual API calls or repeated requests to the endpoint. Ensure all API endpoints enforce authentication and validate user permissions.

Impact Analysis

Attackers could gain unauthorized access to user accounts by obtaining plaintext passwords. This could lead to data breaches, unauthorized data access, or further system compromise.

Compliance Impact

This vulnerability likely violates GDPR (data protection) and HIPAA (health data security) due to unauthorized access to sensitive credentials. Organizations may face legal penalties and reputational damage.

Mitigation Strategies

Immediately restrict access to the EasyFlow .NET API endpoints to authenticated users only. Update the system to the latest patched version if available. Monitor network traffic for unauthorized access attempts to sensitive API endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102458. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart