Skip to content
OpenAdvisories
Critical VDE-2026-102 1 CVE

WAGO: Unauthorized Account Access via Credential Recovery Process

Published Nov 4, 2026 · Updated Nov 4, 2026

Vendor: WAGO Product: Building Cloud Services Product: Software

Summary

A vulnerability in the authentication and credential recovery process may allow an unauthenticated attacker to bypass intended verification controls during password reset operations. By exploiting this weakness, an attacker could reset credentials for arbitrary user accounts and gain unauthorized access without possessing valid authentication credentials.

Details

Impact
Successful exploitation could lead to unauthorized account takeover and access to application resources with the privileges of the compromised user. Depending on the affected account's permissions, this may result in unauthorized access to sensitive information, misuse of privileged functions, modification of system settings, or broader compromise of the affected environment.

Remediation
The vulnerability was remediated in the Building Cloud Service on August 26, and as the service is centrally managed and updated automatically, no customer action is required to apply the security fix. Customers are advised to review user account activity and verify that no passwords have been changed unexpectedly prior to remediation.

Vulnerabilities 1

Revision history

  1. #1.0.0

    Initial release.

References