CVE-2026-4592 - kalcaddle kodbox Password Login index.class.php tfaVerify improper authentication

Back Back to CVE browser

MEDIUM

kalcaddle kodbox Password Login index.class.php tfaVerify improper authentication

Published Mar 23, 2026

6.3

MEDIUM

CVSS 4.0

EPSS 0.55%

Description

A security vulnerability has been detected in kalcaddle kodbox 1.64. This impacts the function loginAfter/tfaVerify of the file /workspace/source-code/plugins/client/controller/tfa/index.class.php of the component Password Login. The manipulation leads to improper authentication. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor Kalcaddle Product Kodbox Default
n/a
- Version
  1.64
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Kalcaddle

Kodbox

n/a

Version	Status	Constraints
1.64	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-14459
Advisory
https://vuldb.com/?ctiid.352428
signaturepermissions-required
https://vuldb.com/?id.352428
vdb-entrytechnical-description
https://vuldb.com/?submit.775471
third-party-advisory
https://vulnplus-note.wetolink.com/share/S6CMNnndYUXU
broken-linkexploit

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-14459		Advisory
https://vuldb.com/?ctiid.352428		signaturepermissions-required
https://vuldb.com/?id.352428		vdb-entrytechnical-description
https://vuldb.com/?submit.775471		third-party-advisory
https://vulnplus-note.wetolink.com/share/S6CMNnndYUXU		broken-linkexploit