Prior to version 1.6.3, Known exposes password reset tokens through a hidden input field on the reset page. An attacker who can identify a target's email address can request a reset and read the token embedded in the response. With this token the attacker can reset the account password and later log in as that user. The flaw is a classic data exposure combined with credential management weakness, allowing full compromise of the account without needing access to the victim’s email.

The affected platform is the social‑publishing application Known, maintained by withknown. Any installation running Known 1.6.2 or earlier is susceptible. The patch that fixes the issue is released as version 1.6.3 and onward. No other vendors have been listed in the impact data.

The vulnerability carries a CVSS score of 9.8, indicating a critical severity. The EPSS score is below one percent, so the likelihood of exploitation is currently low, but the low effort and high impact mean that it remains a priority for mitigation. Known is not yet listed in the CISA KEV catalog, but the high exposure ratings call for fast action. Attackers can exploit the flaw over the public web interface, requiring only an email address for the target.