CVE-2026-32865CWE-200CWE-640

OPEXUS eComplaint and eCase insecure password reset

Critical · published March 19, 2026

CVSS v4.0
9.2
EPSS
1%
Percentile
44.5
In the wild
Unconfirmed
What it is

OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswordReset.aspx'. An attacker who knows an existing user's email address can reset the user's password and security questions. Existing security questions are not asked during the process.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00538 · 44.5th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
Published
2026-03-19T15:47Z
EPSS history
Timeline
  • 19 MAR 15:47Z
    OPEXUS eComplaint and eCase insecure password reset
    cvelistv5