Description
XWEB EVO 5.6.2 through 5.8.8 contains an authentication bypass vulnerability that allows unauthenticated attackers to set the password of any account flagged must-reset-at-next-login by exploiting missing session validation in the users.lua update_password action. Attackers can reset the password of newly onboarded operator accounts, clearing the password_expiration flag and gaining an immediately usable authenticated foothold on the system. This product line reached it's end of service date in March 2026.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Copeland | XWEB EVO | 5.6.2 – ≤ 5.8.8 | — |
References
- Software Download patch product
- End of Support Announcement vendor-advisory
- VulnCheck Advisory: Dixell/Copeland XWEB EVO Authentication Bypass via users.lua third-party-advisory