CVE-2026-1693CWE-1390CWE-477

Use of vulnerable Resource Owner Password Credentials flow

Medium · published February 26, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
23.9
In the wild
Unconfirmed
What it is

The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow a remote attacker to steal user credentials.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y/R:U/RE:M/U:Clear
EPSS
0.00314 · 23.9th percentile
Weaknesses
CWE-1390 · Weak Authentication; CWE-477 · Use of Obsolete Function
Published
2026-02-26T07:56Z
EPSS history
Timeline
  • 26 FEB 07:56Z
    Use of vulnerable Resource Owner Password Credentials flow
    cvelistv5