CODESYS CODESYS Visualization — Schwachstelle CVE-2026-0393

The affected product may expose credentials remotely between low privileged visualization users during concurrent login operations due to insufficient isolation of authentication data. The vulnerability affects only login operations within an active visualization session.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Two alternative mitigation options have been identified. One option is to avoid using the Input Action "User Management -> Login" for changing users within an active visualization session. Instead, use the Input Action "User Management -> Logout" to do a complete logout followed by a new Login to the Visualization to re-login with another user. Alternatively, property handling within the visualization can be disabled via Project Settings -> Visualization -> General -> Advanced -> "Activate property handling in all element properties", if this is not required for the compilation of the application.