Threats tagged 'ghsa-9jf9-f234-pgj9'

XWEB EVO versions 5.6.2 through 5.8.8 have an authentication bypass vulnerability that allows unauthenticated attackers to reset the password of any account flagged to reset at next login. This occurs due to missing session validation in the users.lua update_password action. Exploiting this flaw, attackers can gain immediate authenticated access by resetting passwords of newly onboarded operator accounts. The product line is end-of-service as of March 2026.