A vulnerability was found in kalcaddle kodbox 1.64. It has been classified as critical. This impacts the function
loginAfter/tfaVerify of the file /workspace/source-code/plugins/client/controller/tfa/index.class.php of the component Password Login. The manipulation leads to improper authentication.
This vulnerability is uniquely identified as CVE-2026-4592. The attack is possible to be carried out remotely. Moreover, an exploit is present.
The vendor was contacted early about this disclosure but did not respond in any way.
