CVE-2026-124015: Dixell/Copeland XWEB EVO Authentication Bypass via users.lua

Published Nov 12, 2026

Updated

XWEB EVO 5.6.2 through 5.8.8 contains an authentication bypass vulnerability that allows unauthenticated attackers to set the password of any account flagged must-reset-at-next-login by exploiting missing session validation in the users.lua updatepassword action. Attackers can reset the password of newly onboarded operator accounts, clearing the passwordexpiration flag and gaining an immediately usable authenticated foothold on the system. This product line reached it's end of service date in March 2026.

Event History

Nov 12, 2026

CVE Published

via MITRE·08:07 PM

Data Sourced

via MITRE·08:07 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which XWEB EVO versions should be treated as affected?

XWEB EVO versions 5.6.2 through 5.8.8 are affected. The product line reached end of service in March 2026.

What does an attacker need to exploit this issue?

An attacker does not need prior authentication or user interaction. Exploitation requires an account that is flagged to reset its password at the next login, such as a newly onboarded operator account.

How can I identify whether a system may be exposed to takeover?

Check whether the appliance runs a version from 5.6.2 through 5.8.8 and whether any accounts have the must-reset-at-next-login or password_expiration state. Such accounts can have their passwords reset and become immediately usable by an unauthenticated attacker.

CVE-2026-124015: Dixell/Copeland XWEB EVO Authentication Bypass via users.lua

Event History

Frequently Asked Questions

Which XWEB EVO versions should be treated as affected?

What does an attacker need to exploit this issue?

How can I identify whether a system may be exposed to takeover?

Company

Resources

Contact

Frequently Asked Questions

Which XWEB EVO versions should be treated as affected?

What does an attacker need to exploit this issue?

How can I identify whether a system may be exposed to takeover?