A misconfiguration of security attributes in Kiteworks Secure Data Forms may allow credentials to be transmitted without encryption. This flaw, classified as CWE-523, could expose sensitive authentication data to interception, compromising confidentiality for users who rely on the platform for secure data handling.

The vulnerability affects Kiteworks Secure Data Forms versions earlier than 9.2.1. Administrators managing installations of the product before the identified patch should verify whether the configuration settings may permit unencrypted credential traffic.

The CVSS score of 6.5 indicates moderate risk, and the EPSS score of less than 1% suggests a low probability of active exploitation. It is not listed in the CISA KEV catalog. Exploitation requires that the security attributes be improperly set; once that condition exists an attacker can capture credentials in transit on the network.