CVE-2026-102090 describes an open redirect vulnerability in Kiteworks Core prior to version 9.5.1. The issue arises from insufficient validation of a URL parameter in the PDF viewer, enabling an attacker to inject content that is displayed under the legitimate domain's trust context. This can be exploited to enhance phishing attempts by embedding malicious links in the displayed content. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction required, and limited impact on integrity only.

The vulnerability does not directly compromise confidentiality or availability but can be leveraged to increase the credibility of phishing attacks by displaying attacker-controlled documents within the trusted application domain. This may lead to users being more likely to trust malicious links, potentially resulting in further social engineering or credential theft.

A fix is available in Kiteworks Core version 9.5.1 and later. Users should upgrade to version 9.5.1 or above to remediate this vulnerability. No additional mitigation guidance is provided or required beyond applying the official update.