EUVD-2026-78256
GHSA-4w5x-hqjj-crcv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the out-of-band token acquisition prerequisite; UI:R captures the requirement that the victim must have authenticated; PR:N because the attacker holds no xClick credentials.
Primary rating from Vendor (FSI).
CVSS VectorVendor: FSI
Lifecycle Timeline
2DescriptionCVE.org
Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass.
This issue affects xClick: R2, R3, and R3.1.
AnalysisAI
Insufficient session expiration in bizwell xClick groupware allows authentication bypass through replay of session tokens that should have been invalidated after logout or timeout. Affecting versions R2, R3, and R3.1, the flaw enables an attacker who has obtained a victim's session token to continue using it with full account-level access even after the legitimate session should have ended, carrying high confidentiality, integrity, and availability impact per the CVSS 4.0 score of 8.7. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker first acquire a valid xClick session token from a targeted user on an affected version (R2, R3, or R3.1). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) reflects a network-reachable, low-complexity attack requiring only passive victim interaction - the target must have authenticated to xClick to generate a reusable token. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact fixed version number is specified in the available intelligence; organizations running xClick R2, R3, or R3.1 should contact bizwell directly via https://www.bizwell.net/solutions/groupware to obtain current patched builds and confirm remediation scope. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately invalidate all active user sessions across bizwell xClick deployments and require re-authentication; prioritize terminating sessions for administrative and high-privilege accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today