OPEXUS eComplaint and eCASE leak a secret verification code in the HTTP response when an account password reset is requested through the ForcePasswordReset.aspx endpoint. An attacker who knows a user’s email address can use this code to reset the user’s password and overwrite the security questions without being prompted for the existing questions. This flaw exposes sensitive information (CWE‑200) and allows unauthorized password reset (CWE‑640), resulting in full account takeover and compromise of confidentiality, integrity, and trust for the affected users.

The vulnerability affects OPEXUS eCase and eComplaint prior to version 10.1.0.0. Any installation of these products that has not been upgraded beyond that release is susceptible.

The high CVSS score of 9.2 signals a critical impact, but the EPSS score of less than 1% indicates low likelihood of exploitation at this time and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack vector is inferred to be remote, via the web interface, as the vulnerable endpoint is an HTTP service. An attacker would need the target email address, which may be leaked or discovered through other means, to exploit the flaw.