Description
EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API.
Published: 2026-09-30
Score: 9.3 Critical
EPSS: n/a
KEV: No
Impact: Credential Theft
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a missing authentication flaw (CWE-306) in DigiWin EasyFlow .NET. Unauthenticated remote attackers can call a specific API and retrieve plaintext passwords of other users, enabling credential theft and potential unauthorized access to user accounts.

Affected Systems

The affected product is DigiWin EasyFlow .NET. Any deployment of this product prior to the patch released after April 17, 2026 may be vulnerable, as no specific version numbers are listed in the advisory.

Risk and Exploitability

The CVSS score of 9.3 indicates a high impact vulnerability. EPSS is not available, and the issue is not listed in CISA KEV, but the lack of authentication provides a straightforward attack vector for remote attackers. An attacker who can reach the vulnerable API can obtain sensitive credentials without any prerequisite, increasing the likelihood of exploitation.

Generated by OpenCVE AI on September 30, 2026 at 11:59 UTC.

Remediation

Vendor Solution

Update to the patch version released after April 17, 2026.

OpenCVE Recommended Actions

  • Apply the vendor patch released after April 17, 2026 to the EasyFlow .NET system.
  • Disable or restrict access to the vulnerable API endpoint until the patch is applied.
  • Implement network segmentation or firewall rules to block unauthenticated external access to the EasyFlow .NET services.

Generated by OpenCVE AI on September 30, 2026 at 11:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
First Time appeared Digiwin
Digiwin easyflow .net
Vendors & Products Digiwin
Digiwin easyflow .net

Wed, 30 Sep 2026 09:00:00 +0000

Type Values Removed Values Added
Description EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API.
Title DigiWin｜EasyFlow .NET - Missing Authentication
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Digiwin Easyflow .net
cve-icon MITRE

Status: PUBLISHED

Assigner: twcert

Published:

Updated: 2026-09-30T08:34:09.950Z

Reserved: 2026-09-29T08:18:21.533Z

Link: CVE-2026-102458

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-30T09:17:13.800

Modified: 2026-09-30T09:17:13.800

Link: CVE-2026-102458

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T12:00:16Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function