# CVE-2026-102115: Kiteworks Core authentication bypass in password reset

Source: https://junglewise.ai/threats/cve-2026-102115-kiteworks-core-did-not-correctly-validate-a-parameter-submitted  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-102115 · Severity: critical · CVSS 9.8 · Published 2026-09-30

Kiteworks Core, a secure content collaboration and file transfer platform, contains a flaw in its password reset workflow that allows unauthenticated attackers to reset user passwords without ownership of the account's email. An attacker knowing only a user's email address can bypass authentication entirely, including for administrative accounts, leading to complete account takeover and unauthorized administrative access.

Technologies: [Kiteworks Core](https://junglewise.ai/threats/technologies/kiteworks-core). Vendors: [Kiteworks](https://junglewise.ai/threats/vendors/kiteworks).

## Quick answers

**Is CVE-2026-102115 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102115 being exploited in the wild.

**How severe is CVE-2026-102115?** Critical severity, with a CVSS score of 9.8, published 30 September 2026.

**Which products and versions are affected?** Kiteworks Core before 9.5.0.

**Is there a fix for CVE-2026-102115?** A patch was published on 2026-09-30: Version 9.5.0 resolves the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102115 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-102115?** Check whether you run Kiteworks Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from improper validation of a parameter in the password reset workflow (CWE-1287, CWE-697). An unauthenticated attacker with only a user's email address can reset the password without possessing or intercepting the legitimate password reset token sent via email. This flaw affects all Kiteworks Core versions prior to 9.5.0 and is reachable via network without authentication or user interaction, enabling full account compromise including administrative privilege escalation.

## Affected products

- Kiteworks Core before 9.5.0

## Timeline

- 2026-09-30: disclosed: Advisory published
- 2026-09-30: patched: Version 9.5.0 resolves the vulnerability

## References

- [https://github.com/kiteworks/security-advisories/security/advisories/GHSA-q76w-qv9j-q639](https://github.com/kiteworks/security-advisories/security/advisories/GHSA-q76w-qv9j-q639)
- [https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json)

## Related threats

- [Kiteworks Core stored cross-site scripting in administrative interface](https://junglewise.ai/threats/cve-2026-102147-a-stored-cross-site-scripting-xss-weakness-in-kiteworks-core)
- [Kiteworks Core SSRF via CRLF injection](https://junglewise.ai/threats/cve-2026-102145-an-authenticated-administrator-could-cause-the-server-to-issue)
- [Kiteworks Core remote code execution in notification template](https://junglewise.ai/threats/cve-2026-102142-a-system-notification-template-on-the-kiteworks-appliance-was)
- [Kiteworks Core privilege escalation in cluster-management operations](https://junglewise.ai/threats/cve-2026-102141-two-kiteworks-core-cluster-management-operations-did-not)
- [Kiteworks Core insufficient verification of data authenticity in import](https://junglewise.ai/threats/cve-2026-102140-an-authenticated-administrator-could-initiate-an-administrative)