CVE-2026-1695: PcVue OAuth Services XSS Vulnerability

CVE-2026-1695 Overview

A Cross-Site Scripting (XSS) vulnerability has been identified in the OAuth web services used by several PcVue features including WebVue, WebScheduler, TouchVue, and SnapVue. This vulnerability affects PcVue versions 12.0.0 through 16.3.3 and could allow a remote attacker to trick legitimate users into loading malicious content from external sites during failed authentication attempts on applications with unknown client_id values.

The vulnerability is specifically limited to the error page of the OAuth server, which is displayed when user authentication fails for an unrecognized application.

Critical Impact

Remote attackers can exploit this XSS vulnerability to inject malicious content into OAuth error pages, potentially leading to session hijacking, credential theft, or phishing attacks targeting legitimate PcVue users.

Affected Products

• PcVue version 12.0.0 through 16.3.3
• WebVue, WebScheduler, TouchVue, and SnapVue features utilizing OAuth web services
• PcVue OAuth server error pages

Discovery Timeline

• February 26, 2026 - CVE CVE-2026-1695 published to NVD
• February 26, 2026 - Last updated in NVD database

Technical Details for CVE-2026-1695

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). The flaw exists within the OAuth authentication error handling mechanism of PcVue's web-based features.

When a user attempts to authenticate with an unrecognized client_id, the OAuth server generates an error page. The vulnerability occurs because user-supplied input is not properly sanitized before being rendered in this error page, allowing attackers to inject arbitrary JavaScript or HTML content.

The attack requires user interaction, as the victim must be tricked into clicking a malicious link or visiting a crafted URL that triggers the OAuth error page with injected content. This could be achieved through phishing emails, social engineering, or malicious website redirects.

Root Cause

The root cause of this vulnerability is insufficient input validation and output encoding in the OAuth server's error page generation. When processing authentication requests with invalid or unknown client_id parameters, the server fails to properly sanitize or encode these values before reflecting them in the error response HTML. This allows attacker-controlled input to be interpreted as executable code by the victim's browser.

Attack Vector

The attack is network-based and requires the attacker to craft a malicious URL containing XSS payload within the OAuth request parameters. The attacker must then convince a legitimate user to visit this crafted URL, typically through social engineering techniques such as phishing emails or malicious links embedded in other web content.

When the victim accesses the malicious URL, the PcVue OAuth server processes the request, fails to recognize the crafted client_id, and generates an error page that includes the unsanitized attacker payload. The victim's browser then executes the injected script in the context of the PcVue OAuth domain, potentially allowing the attacker to steal session cookies, capture credentials, or redirect the user to malicious content.

The vulnerability mechanism involves improper neutralization of special characters in HTTP request parameters that are subsequently reflected in the OAuth error response page. Technical details and remediation guidance are available in the PCVue Security Bulletin SB2026-2.

Detection Methods for CVE-2026-1695

Indicators of Compromise

• Unusual HTTP requests to PcVue OAuth endpoints containing encoded script tags or JavaScript payloads in URL parameters
• Error page responses from the OAuth server that contain suspicious <script> elements or event handlers
• User reports of unexpected redirects or pop-ups when accessing PcVue authentication pages
• Web server logs showing requests with malformed or suspicious client_id values containing special characters

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block common XSS patterns in requests to OAuth endpoints
• Monitor web server access logs for requests containing URL-encoded script tags (%3Cscript%3E) or JavaScript event handlers in query parameters
• Deploy browser-based XSS detection tools to identify reflected content anomalies in OAuth error pages
• Configure SIEM alerts for multiple failed OAuth authentication attempts from single IP addresses with varying payload patterns

Monitoring Recommendations

• Enable verbose logging on PcVue OAuth server components to capture full request details including all parameters
• Implement Content Security Policy (CSP) headers to detect and report XSS attempts through CSP violation reports
• Monitor for unusual patterns in OAuth authentication failures that may indicate exploitation attempts
• Establish baseline metrics for OAuth error page access frequency to detect anomalous spikes in traffic

How to Mitigate CVE-2026-1695

Immediate Actions Required

• Review the PCVue Security Bulletin SB2026-2 for vendor-specific remediation guidance
• Update PcVue installations to a patched version as soon as vendor updates are available
• Implement web application firewall rules to filter malicious input targeting OAuth endpoints
• Educate users about the risks of clicking suspicious links, especially those appearing to lead to PcVue authentication pages

Patch Information

Consult the official PCVue Security Bulletin SB2026-2 for detailed patch information and updated software versions that address this vulnerability. Organizations should prioritize applying vendor-provided security updates to remediate this XSS vulnerability.

Workarounds

• Deploy a web application firewall (WAF) configured with XSS filtering rules in front of PcVue OAuth services to sanitize incoming requests
• Implement Content Security Policy (CSP) headers to restrict script execution sources and mitigate the impact of successful XSS attacks
• Consider restricting network access to PcVue OAuth endpoints to trusted IP ranges where feasible to reduce the attack surface
• Enable HTTP-only and Secure flags on all session cookies to limit the impact of potential cookie theft via XSS

# Example WAF configuration to block common XSS patterns (ModSecurity)
SecRule REQUEST_URI "@contains /oauth" \
    "id:1001,phase:1,deny,status:403,msg:'Potential XSS in OAuth request',\
    chain"
    SecRule ARGS "@rx <script|javascript:|on\w+=" "t:lowercase,t:urlDecodeUni"