CVE-2026-124015

XWEB EVO 5.6.2 through 5.8.8 contains an authentication bypass vulnerability that allows unauthenticated attackers to set the password of any account flagged must-reset-at-next-login by exploiting missing session validation in the users.lua update password action. Attackers can reset the password of newly onboarded operator accounts, clearing the password expiration flag and gaining an immediately usable authenticated foothold on the system. This product line reached it's end of service date in March 2026.