CVE-2026-124012

XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the Administrator web account is configured to use passwordmode dailypassword with no stored password, as the Users.authenticate function in lualibusers.lua synthesizes the Administrator configuration without...

CVE-2026-124012 Dixell/Copeland XWEB EVO Hardcoded Administrator Daily Password Authentication Bypass

XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the Administrator web account is configured to use passwordmode dailypassword with no stored password, as the Users.authenticate function in lualibusers.lua synthesizes the Administrator configuration without...

CVE-2026-124012

The XWEB EVO (versions 5.6.2 through 5.8.8) is affected by a hardcoded credential vulnerability. The Users.authenticate function in lualib_users.lua synthesizes the Administrator configuration without validating a stored secret, allowing the account to use a daily_password mode with no stored pas...

CVE-2026-124012: Copeland XWEB EVO: XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the Administrator web account is…

XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the Administrator web account is configured to use passwordmode dailypassword with no stored password, as the Users.authenticate function in lualibusers.lua synthesizes the Administrator configuration without...