CVE-2026-1693 Details
Description
The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow a remote attacker to steal user credentials.
A vulnerability exists in the OAuth Resource Owner Password Credentials (ROPC) flow, which is still utilized by the web services for WebVue, WebScheduler, TouchVue, and Snapvue features in PcVue versions 12.0.0 to 16.3.3. This vulnerability arises from the continued use of a deprecated OAuth flow, potentially allowing remote attackers to steal user credentials.
Users can upgrade to PcVue version 16.3.4 or 15.2.14 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 26, 2026CNA
Assessed Jan 1, 1References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.pcvue.com/security/#SB2026-2 | arcinfo | Vendor Advisory |
Weakness Enumeration
Affected Products
| Product | Versions |
|---|---|
| arcinfo pcvue | >= 12.0.0, <= 15.2.13 >= 16.0.0, < 16.3.4 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CPE Deprecation Remap | [email protected] |
| Jul 9, 2026 | CPE Deprecation Remap | [email protected] |
| Jun 17, 2026 | CVE Modified | arcinfo |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 12, 2026 | Initial Analysis | [email protected] |
| Feb 26, 2026 | New CVE Received | arcinfo |