CVE-2026-102134: CWE-420 Unprotected Alternate Channel in Kiteworks Core
Kiteworks Core has a vulnerability where its gateway-level API security controls are not applied to all requests authenticated via the central authentication service. This allows an authenticated user to access REST API functions through a request path that bypasses controls such as enforcement of signed-out and revoked sessions. The vulnerability affects versions from 0 up to but not including 9.5.1. The CVSS 3.1 base score is 5.4, indicating a medium severity issue.
AI Analysis
Technical Summary
CVE-2026-102134 is a CWE-420 Unprotected Alternate Channel vulnerability in Kiteworks Core. The platform's gateway-level API security controls, including session revocation and sign-out enforcement, are not consistently applied to all REST API requests authenticated through the central authentication service. This creates an alternate request path that an authenticated user can exploit to access API functionality without proper security checks. The issue affects Kiteworks Core versions >=0 and <9.5.1.
Potential Impact
An authenticated user could bypass critical API security controls, including enforcement of signed-out and revoked sessions, potentially allowing unauthorized access to REST API functionality. The impact is limited to confidentiality and integrity with no availability impact reported. The CVSS score of 5.4 reflects a medium severity risk.
Mitigation Recommendations
No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should monitor vendor communications for updates and consider restricting access to the affected API endpoints where possible.
CVE-2026-102134: CWE-420 Unprotected Alternate Channel in Kiteworks Core
Description
Kiteworks Core has a vulnerability where its gateway-level API security controls are not applied to all requests authenticated via the central authentication service. This allows an authenticated user to access REST API functions through a request path that bypasses controls such as enforcement of signed-out and revoked sessions. The vulnerability affects versions from 0 up to but not including 9.5.1. The CVSS 3.1 base score is 5.4, indicating a medium severity issue.
CVSS v3.1
Score 5.4medium
Affected software
Kiteworks
Core
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-102134 is a CWE-420 Unprotected Alternate Channel vulnerability in Kiteworks Core. The platform's gateway-level API security controls, including session revocation and sign-out enforcement, are not consistently applied to all REST API requests authenticated through the central authentication service. This creates an alternate request path that an authenticated user can exploit to access API functionality without proper security checks. The issue affects Kiteworks Core versions >=0 and <9.5.1.
Potential Impact
An authenticated user could bypass critical API security controls, including enforcement of signed-out and revoked sessions, potentially allowing unauthorized access to REST API functionality. The impact is limited to confidentiality and integrity with no availability impact reported. The CVSS score of 5.4 reflects a medium severity risk.
Mitigation Recommendations
No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should monitor vendor communications for updates and consider restricting access to the affected API endpoints where possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- cisa-cg
- Date Reserved
- 2026-09-28T17:39:13.563Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abd72512a4e24523d8ebe28
Added to database: 09/30/2026, 20:34:25 UTC
Last enriched: 09/30/2026, 20:49:48 UTC
Last updated: 10/01/2026, 04:47:11 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.