OPEXUS eComplaint and eCASE Insecure Password Reset Vulnerability
Vulnerability
A vulnerability exists in OPEXUS eComplaint and eCASE versions prior to 10.1.0.0, where the secret verification code is included in the HTTP response during password reset requests via 'ForcePasswordReset.aspx'. This allows an attacker with knowledge of a user's email address to reset the user's password and security questions, bypassing the existing security questions which are not prompted during the process.
Impact
Exploitation of this vulnerability allows for unauthorized password resets and security question changes, potentially leading to account takeover.
Added: Mar 19, 2026, 4:21 PM
Updated: Mar 19, 2026, 4:21 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
1.3exploitability
6.2remediation
0.0relevance
4.1threat
0.0urgency
2.9incentive
0.0Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.