Dashboard / CVE-2026-124015

CVE-2026-124015

HIGH
MEDIUM Priority: 0.05 BB Relevance: 77/100
Published: 2026-11-12 Modified: 2026-11-13 First seen: 2026-11-12 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: X
AT: Present
VC: None
VI: High
VA: None

Description

XWEB EVO 5.6.2 through 5.8.8 contains an authentication bypass vulnerability that allows unauthenticated attackers to set the password of any account flagged must-reset-at-next-login by exploiting missing session validation in the users.lua update_password action. Attackers can reset the password of newly onboarded operator accounts, clearing the password_expiration flag and gaining an immediately usable authenticated foothold on the system. This product line reached it's end of service date in March 2026.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
Copeland XWEB EVO 5.6.2
Copeland XWEB EVO 5.6.2
Copeland XWEB EVO 5.6.2

References & Advisories (4)

Bug Bounty Relevance

77 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

8.2 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.60%
Raw Score 0.006030
Percentile 49.4%
Date 2026-11-13

Intelligence Sources

mitre ref →
nvd ref →

External Links