EUVD-2026-14445
GHSA-9gjx-rgv5-g8mx
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A security flaw has been discovered in kalcaddle kodbox 1.64. The impacted element is an unknown function of the file /workspace/source-code/plugins/oauth/controller/bind/index.class.php of the component loginSubmit API. Performing a manipulation of the argument third results in cross-site request forgery. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is regarded as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
A cross-site request forgery (CSRF) vulnerability exists in Kalcaddle Kodbox 1.64 affecting the loginSubmit API endpoint within the OAuth bind controller. An unauthenticated remote attacker can manipulate the 'third' parameter to forge requests that modify application state, though the attack requires user interaction and high complexity. A public proof-of-concept exploit has been released, and the vendor has not responded to early disclosure notifications.
Technical ContextAI
The vulnerability is rooted in CWE-352 (Cross-Site Request Forgery), a classic web application flaw where an application fails to validate that state-changing requests originate from legitimate users. The affected component is the PHP-based OAuth bind controller at /workspace/source-code/plugins/oauth/controller/bind/index.class.php, specifically within the loginSubmit API handler. Kodbox is a file management platform built on PHP, and this CSRF flaw exists because the application does not implement proper CSRF token validation or SameSite cookie attributes on the OAuth authentication flow. The 'third' parameter manipulation suggests an attacker can inject or modify OAuth provider identifiers or callback mechanisms, allowing them to redirect authentication flows or bind unauthorized OAuth accounts to victims' sessions.
RemediationAI
Immediate action should include upgrading Kodbox to the latest available version beyond 1.64; however, verify patch availability directly with the Kalcaddle project or community channels given the vendor's non-response to disclosure. As an interim workaround, implement CSRF protections at the application or reverse proxy level: enforce CSRF tokens on all OAuth bind endpoints, implement SameSite=Strict cookie attributes on session cookies, and restrict OAuth configuration changes to authenticated sessions with additional re-authentication. Network segmentation and WAF rules blocking suspicious OAuth callback parameters can provide defense-in-depth. Monitor logs for repeated OAuth bind attempts or anomalous third-party provider binding activity. The public POC (https://vulnplus-note.wetolink.com/share/IJW1LjsyomCQ) should be reviewed in a controlled environment to understand the specific attack mechanism and tailor detection signatures accordingly.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today