Pcvue CVE-2026-1693
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow a remote attacker to steal user credentials.
AnalysisAI
PcVue versions 12.0.0 through 16.3.3 use the deprecated OAuth Resource Owner Password Credentials flow in their web services, enabling remote attackers to steal user credentials without authentication or user interaction. The vulnerability affects WebVue, WebScheduler, TouchVue, and Snapvue components and carries a high severity rating with no patch currently available.
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all PcVue deployments and identify affected versions (12.0.0-16.3.3); disable ROPC authentication if alternative OAuth flows are available and document the change. Within 7 days: Implement network segmentation to restrict web service access to authorized networks only; increase monitoring and logging of OAuth authentication attempts; contact vendor for patch timeline. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today