Digiwin EasyFlow .NET CVE-2026-12581

The attacker must be able to plant a chosen session identifier on the victim's browser (typically via phishing link with a session ID parameter, cross-site scripting in a related origin, or a man-on-the-side network position) AND the victim must subsequently log in to EasyFlow .NET while still holding that planted session ID. The CVSS 4.0 vector confirms UI:P (passive user interaction - the victim simply logs in normally) and AT:P (an attack requirement beyond the baseline, here the session-planting precondition). No authentication is required of the attacker (PR:N), the attack is network-reachable (AV:N), and no special non-default configuration of EasyFlow itself is described - the flaw appears intrinsic to how the product handles session lifecycle across the authentication boundary.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H) indicates network-reachable, low-complexity exploitation requiring no privileges but with attack requirements (AT:P) and user interaction (UI:P) - the attacker must induce the victim to use the planted session ID and then log in. There is no EPSS score, no CISA KEV listing, and no public POC referenced, so this is not confirmed actively exploited; exploitation status is best characterized as no public exploit identified at time of analysis. The realistic risk is moderate-to-high for internet-exposed EasyFlow .NET deployments where attackers can phish or otherwise plant a session cookie, but is materially limited by the user-interaction requirement, meaning opportunistic mass exploitation is unlikely while targeted attacks against specific users are plausible.

An attacker visits the EasyFlow .NET login page, captures or generates a valid pre-authentication session identifier, then delivers that session ID to a target user via a crafted phishing link (e.g., a URL parameter or pre-set cookie via cross-site scripting in a sibling app). Once the victim authenticates within that session, the attacker - still holding the same session ID - replays it and inherits the victim's authenticated privileges within EasyFlow workflows. No public POC is referenced, but the attack pattern is well documented and trivially reproducible for any tester familiar with CWE-384.