Authentication Bypass in Dixell/Copeland XWEB EVO Product Series

CVE-2026-124015

What is CVE-2026-124015?

The XWEB EVO product line by Dixell/Copeland versions 5.6.2 through 5.8.8 is susceptible to an authentication bypass vulnerability. This flaw allows attackers, without prior authentication, to exploit inadequate session validation in the users.lua update_password action. Specifically, it enables them to reset passwords for accounts that require a password reset upon next login. By circumventing security measures, attackers can manipulate newly created operator accounts and deactivate the password expiration feature, providing them with immediate unauthorized access to the system. Note that the affected product line reached its end of service date in March 2026, emphasizing the urgency for organizations to address this vulnerability.

References