EUVD-2026-14459Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The vulnerability presents moderate real-world risk despite apparent disclosure and exploit availability. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates remote network attack surface (AV:N) but requires high attack complexity (AC:H), suggesting the exploit is not trivial to execute and may require specific conditions or multiple steps. The EPSS score of P (Proof-of-Concept) indicates publicly available exploit code exists, elevating practical risk. However, the lack of KEV status (RL:X indicates unknown remediation level) and unresponsive vendor communication suggest this may be an abandoned or low-priority product. Organizations running Kodbox 1.64 should prioritize patching, but this is not an immediate worm-like threat; rather, it requires targeted attack with technical skill. The integrity and confidentiality impact (I:L, C:L) are limited rather than complete, and availability impact (A:L) is also low-level. |
| Exploit ScenarioDerived | An attacker with network access to a Kodbox instance could craft a specially designed request to the /workspace/source-code/plugins/client/controller/tfa/index.class.php loginAfter/tfaVerify endpoint, exploiting the improper authentication logic to bypass the two-factor authentication check even without possessing the valid second factor (e.g., TOTP code or security key). While the high attack complexity (AC:H) means this requires understanding of the specific authentication bypass technique (which is available in the public POC), a skilled attacker could gain unauthorized access to Kodbox user accounts and the files/data they contain without needing the legitimate user's TFA credential. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 23, 2026
Improper authentication in the two-factor authentication verification function of Kalcaddle Kodbox 1.64 allows remote attackers to bypass login controls with high complexity exploitation. Public exploit code exists for this vulnerability, and the vendor has not provided a patch despite early notification. Affected users should implement network-level access controls while awaiting a vendor update.
Earlier versions of this analysis (1)
An improper authentication vulnerability exists in Kalcaddle Kodbox 1.64 within the Two-Factor Authentication (TFA) verification function (loginAfter/tfaVerify), allowing remote attackers to bypass authentication controls and gain unauthorized access. The vulnerability resides in the password login component and has been publicly disclosed with a proof-of-concept exploit available, though exploitation requires high complexity techniques. With a CVSS score of 5.6 and confirmed public exploit availability, this represents a moderate but real risk to affected deployments, particularly for organizations relying on Kodbox for access control.
RemediationAI
The primary remediation is to upgrade Kalcaddle Kodbox to a version newer than 1.64 if available; however, given the vendor's non-response to disclosure, verify patch availability directly from Kalcaddle or monitor https://vuldb.com/?id.352428 for vendor response. If an immediate patch is unavailable, implement compensating controls: restrict Kodbox access to trusted IP ranges via network firewall or WAF, enforce strong password policies to reduce likelihood of compromise, monitor authentication logs for suspicious TFA verification failures or bypass attempts, and consider disabling direct remote access to Kodbox until a patch is confirmed available. If possible, disable the affected TFA endpoint at the reverse proxy level while maintaining alternative authentication controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-287 (Improper Authentication), a foundational authentication bypass flaw in the TFA verification logic of Kodbox. The affected component is the PHP-based TFA controller located at /workspace/source-code/plugins/client/controller/tfa/index.class.php, specifically the loginAfter/tfaVerify function. Kodbox (cpe:2.3:a:kalcaddle:kodbox) is a PHP-based file management and collaboration platform; the vulnerability exploits a weakness in how the two-factor authentication verification process validates user credentials after initial login, potentially allowing attackers to circumvent the secondary authentication factor that should protect against unauthorized account access.
Know when Kodbox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A security vulnerability has been detected in kalcaddle kodbox 1.64. This impacts the function loginAfter/tfaVerify of the file /workspace/source-code/plugins/client/controller/tfa/index.class.php of the component Password Login. The manipulation leads to improper authentication. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Organizations using A security vulnerability should be aware of moderate risk from CVE-2026-4592, a improper authentication vulnerability rated CVSS 5.6. This could allow unauthorized access to protected resources. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access, enable MFA, monitor auth logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in kalcaddle kodbox Multiple Vulnerabilities
View all 7kodbox 1.46.01 has a security flaw that enables user enumeration. Rated critical severity (CVSS 9.8), this vulnerability
A vulnerability was found in kodbox 1.26. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. P
A vulnerability was found in kalcaddle kodbox up to 1.48. Rated critical severity (CVSS 9.8), this vulnerability is remo
A vulnerability was found in kalcaddle kodbox up to 1.48. Rated critical severity (CVSS 9.8), this vulnerability is remo
Improper authorization in KodBox 1.67 Build 02 allows unauthenticated remote attackers to bypass access controls via the
An issue in kodbox v.1.52.04 and before allows a remote attacker to obtain sensitive information via the captcha feature
kodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue. Rated high severity (CVSS 7.5), this vulnerability
Improper authentication in the password-protected share handler of Kalcaddle Kodbox 1.64 allows remote attackers to bypa
Server-side request forgery (SSRF) in Kalcaddle Kodbox up to version 1.64 allows unauthenticated remote attackers to per
An unrestricted file upload vulnerability exists in Kalcaddle Kodbox 1.64 within the Public Share Handler component's us
Remote command injection in Kodbox fileThumb plugin (versions up to 1.64) allows authenticated attackers to execute arbi
GitHub PoC
Exploit-DB