CVE-2026-1695
Cross-Site Scripting in PcVue OAuth Error Pages
Publication date: 2026-02-26
Last updated on: 2026-03-12
Assigner: arcinfo
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| arcinformatique | pcvue | From 16.0.0 (inc) to 16.3.4 (exc) |
| arcinformatique | pcvue | From 12.0.0 (inc) to 15.2.13 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Scripting (XSS) issue affecting the OAuth web services used by the WebVue, WebScheduler, TouchVue, and SnapVue features of PcVue versions 12.0.0 through 16.3.3.
It allows a remote attacker to trick a legitimate user into loading content from another site when the user fails to authenticate successfully on an unknown application (with an unknown client_id).
The vulnerability specifically affects only the error page of the OAuth server.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to execute malicious scripts in the context of the affected OAuth error page.
Such an attack could trick users into interacting with malicious content, potentially leading to phishing, session hijacking, or other malicious activities.
However, the vulnerability requires user interaction (UI:P) and occurs only on the OAuth error page, which may limit the scope of exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know