Password Reset Vulnerability in OPEXUS eComplaint and eCASE by OPEXUS

CVE-2026-32865

What is CVE-2026-32865?

OPEXUS eComplaint and eCASE versions before 10.1.0.0 are vulnerable to an issue where a secret verification code is included in the HTTP response during a password reset request. This allows attackers who have knowledge of a valid user’s email address to reset passwords without any additional security checks. Notably, existing security questions that could provide a layer of verification are bypassed in this process, increasing the risk of unauthorized account access.

References