EUVD-2026-89714
GHSA-m83w-gfx5-2446
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated remote API access with no interaction gives AV:N/AC:L/PR:N/UI:N; the flaw directly discloses passwords (C:H) but does not itself modify or deny service (I:N/A:N), with integrity/availability loss occurring only downstream via credential reuse.
Primary rating from Vendor (twcert).
CVSS VectorVendor: twcert
Lifecycle Timeline
2DescriptionCVE.org
EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API.
AnalysisAI
Unauthenticated remote attackers can retrieve other users' plaintext passwords from Digiwin EasyFlow .NET via a specific API endpoint. This missing authentication vulnerability (CWE-306) affects all versions per the CPE and requires only network reachability to the vulnerable API, as confirmed by the assessed CVSS vector (AV:N/AC:L/PR:N/UI:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default deployments of Digiwin EasyFlow .NET, requiring only network reachability to the affected application's API. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not merely a high-CVSS artifact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch or specific fix version is identified in the available references at the time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether Digiwin EasyFlow .NET is deployed anywhere in the environment and inventory all instances and their network exposure; block external and unnecessary internal access to the product at the perimeter and via segmentation, and confirm the vulnerable API endpoint cannot be reached from untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Easyflow Net
View allSQL Injection in Digiwin EasyFlow .NET enables unauthenticated remote attackers to execute arbitrary SQL commands agains
Critical SQL injection in Digiwin EasyFlow .NET allows unauthenticated remote attackers to execute arbitrary SQL command
Unauthenticated remote code execution affects Digiwin EasyFlow .NET, which deserializes attacker-supplied serialized con
Authenticated administrative users of Digiwin EasyFlow .NET can exploit an arbitrary file upload vulnerability to place
Session fixation in Digiwin EasyFlow .NET allows unauthenticated remote attackers to pre-set a victim's session identifi
Arbitrary file read in Digiwin EasyFlow .NET allows an authenticated remote user to download files from the underlying h
SQL injection in Digiwin EasyFlow .NET allows an authenticated, low-privilege remote user to read arbitrary contents of
Digiwin EasyFlow .NET lacks proper access control for specific functionality, and the functionality do not adequately fi
Reflected cross-site scripting in Digiwin EasyFlow .NET allows unauthenticated remote attackers to execute arbitrary Jav
Stored Cross-Site Scripting in Digiwin's EasyFlow .NET workflow platform enables authenticated low-privilege attackers t
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today