Copeland XWEB EVO up to 5.8.8 Update Password Action users.lua update_password improper authentication

Summaryinfo

A vulnerability identified as very critical has been detected in Copeland XWEB EVO up to 5.8.8. This affects the function update_password of the file users.lua of the component Update Password Action. Performing a manipulation results in improper authentication. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is known as CVE-2026-124015. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in Copeland XWEB EVO up to 5.8.8. It has been classified as very critical. This affects the function update_password of the file users.lua of the component Update Password Action. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

XWEB EVO 5.6.2 through 5.8.8 contains an authentication bypass vulnerability that allows unauthenticated attackers to set the password of any account flagged must-reset-at-next-login by exploiting missing session validation in the users.lua update_password action. Attackers can reset the password of newly onboarded operator accounts, clearing the password_expiration flag and gaining an immediately usable authenticated foothold on the system. This product line reached it's end of service date in March 2026.

It is possible to read the advisory at webapps.copeland.com. This vulnerability is uniquely identified as CVE-2026-124015 since 11/06/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/12/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Copeland

Name

• XWEB EVO

Version

• 5.8.0
• 5.8.1
• 5.8.2
• 5.8.3
• 5.8.4
• 5.8.5
• 5.8.6
• 5.8.7
• 5.8.8

Support

• end of life

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion