Kodbox CVE-2026-4590

This vulnerability presents a low-to-moderate real-world risk despite its CVSS score of 3.1 (Low). The CVSS vector indicates no confidentiality impact, only low integrity impact, no availability impact, no privileges required, network-accessible attack vector, but crucially high attack complexity and required user interaction—all factors that significantly limit practical exploitation. The EPSS metric shows this is exploitable but not prioritized for automated weaponization given the complexity constraints. The existence of a public POC increases risk incrementally but does not fundamentally change the threat model given the requirement for victim interaction (typically clicking a malicious link). The vendor's non-response to early disclosure and the lack of an official patch status further degrade confidence in remediation availability. Using SSVC framework: exploitation is now public (POC released), but automatable exploitation is difficult due to the AC:H rating and UI:R requirement, and technical impact is limited to integrity of session bindings. Priority should be moderate for organizations using Kodbox, particularly those exposed to untrusted user bases, but this is not a critical vulnerability warranting emergency patching.

An attacker crafts a malicious webpage containing a hidden form that targets a Kodbox user's OAuth bind endpoint, pre-filling the 'third' parameter with an attacker-controlled OAuth provider configuration. When a logged-in Kodbox user visits the attacker's site (perhaps via phishing or a compromised advertisement), the form auto-submits via JavaScript without the user's knowledge, causing the victim's Kodbox account to bind to the attacker's OAuth provider, granting the attacker persistent access. The high attack complexity reflects the need for the attacker to understand the specific OAuth provider enumeration or account binding logic, and the required user interaction (visiting the malicious site and being logged into Kodbox simultaneously) limits mass exploitation.