Description

EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-30T09:17:13.800Z",
  "pubdate": "2026-09-30T09:17:13.800Z",
  "executiveSummary": "The EasyFlow .NET platform, developed by Digiwin, is susceptible to a critical Missing Authentication vulnerability. This security flaw allows unauthenticated remote attackers to bypass existing access control mechanisms and interact with sensitive API endpoints. By leveraging this vulnerability, an unauthorized actor can perform unauthorized data retrieval operations, specifically resulting in the exfiltration of plaintext user credentials stored within the system. The vulnerability poses a severe risk to the confidentiality and integrity of the application, as it facilitates full account takeovers without requiring valid credentials or prior system access. The attack surface is exposed via the network, and the exploitability is high due to the lack of validation logic within the affected API. Organizations relying on EasyFlow .NET face immediate risks of data breaches, unauthorized identity impersonation, and lateral movement within the enterprise network if the platform is integrated with corporate authentication services.",
  "technicalDetails": "The vulnerability resides within the API implementation of the EasyFlow .NET application, specifically concerning improper authorization checks during the request handling process. The root cause is the absence of server-side authentication verification for an API endpoint designed to facilitate user management or data synchronization. This flaw violates secure design principles, as the application fails to validate the identity of the requester before processing the request, effectively treating unauthenticated traffic as trusted inputs.\nThe exploitation flow begins with an attacker identifying the vulnerable API endpoint exposed via the HTTP/HTTPS interface. Upon sending a specifically crafted request to this endpoint—which does not include valid authentication headers or session tokens—the application proceeds to execute the back-end function mapped to that route. Because the underlying code lacks a middleware interceptor or a decorative attribute requiring authorization, the application logic executes the data retrieval procedure, which subsequently queries the database for user record details.\nThe payload behavior involves the attacker interacting with the exposed API, which triggers a response containing sensitive user information, including plaintext passwords. This indicates that user credentials are being stored or transmitted in a non-hashed or reversible format, further compounding the impact of the authentication bypass. The lack of cryptographic protection for sensitive credentials ensures that once the API access is achieved, the information is immediately readable to the attacker.\nThis vulnerability is classified as a critical exposure because it requires zero-day knowledge of valid user credentials to compromise the system. The lack of authentication checks effectively turns the administrative or management API into a public-facing data dump. Post-exploitation, an attacker can harvest credentials for all users registered within the EasyFlow .NET environment, leading to full-scale system compromise. The impact is persistent, as the attacker can use the exfiltrated credentials to access legitimate user sessions, modify business workflows, or manipulate proprietary data stored within the EasyFlow environment, essentially gaining persistent unauthorized control over the platform’s business logic and user accounts."
}