CVE-2026-1698CWE-644

HTTP Host header vulnerability in WebClient and WebScheduler web apps

Medium · published February 26, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
11.3
In the wild
Unconfirmed
What it is

A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote attacker to inject harmful payloads that manipulate server-side behavior.

This vulnerability only affects the endpoints /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback and /Authentication/Logout

of the WebClient and WebScheduler web apps.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/AU:Y/R:U/RE:M/U:Clear
EPSS
0.00215 · 11.3th percentile
Weakness
CWE-644 · Improper Neutralization of HTTP Headers for Scripting Syntax
Published
2026-02-26T07:58Z
EPSS history
Timeline
  • 26 FEB 07:58Z
    HTTP Host header vulnerability in WebClient and WebScheduler web apps
    cvelistv5