CVE-2026-124004 · Other
NO FIX YET · SEE WHAT TO DO
XWEB EVO versions before 5.6.2 ship a built-in Administrator account with a hardcoded password. An unauthenticated remote attacker can log in with that credential and get a full admin session over the application.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Organisations running XWEB EVO before 5.6.2 that expose its web interface to a network. The sources state the product line reached end of service in March 2026, so there may be no maintained patch to move to. Teams not running XWEB EVO can skip it.
Not affected if not-exposed-to-network, xweb-evo-5.6.2-or-later
Who cares self-hosted, xweb-evo
5.6.2.5.6.2 or later, per the sources. The product line has reached end of service in March 2026, so a fixed release may not be available for every installation.XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. Attackers can authenticate using the hardcoded credential xwebevonewgeneration in a single request to obtain a complete admin session and full control over the application. This product line reached it's end of service date in March 2026.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.