Vulnerability Description
OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswordReset.aspx'. An attacker who knows an existing user's email address can reset the user's password and security questions. Existing security questions are not asked during the process.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Opexustech | Ecase Ecomplaint | < 10.1.0.0 |
Related Weaknesses (CWE)
References
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/Broken Link
- https://www.cve.org/CVERecord?id=CVE-2026-32865Third Party Advisory
FAQ
What is CVE-2026-32865?
CVE-2026-32865 is a vulnerability with a CVSS score of 9.8 (CRITICAL). OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswordReset.aspx'. An attacker who knows an e...
How severe is CVE-2026-32865?
CVE-2026-32865 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-32865?
Check the references section above for vendor advisories and patch information. Affected products include: Opexustech Ecase Ecomplaint.