HIGH 7.7 NVD
CVE-2026-119744
Cendio ThinLinc contains an improper authentication vulnerability in its browser-based web client (tlwebaccess) that allows an authenticated attacker to imperso
Cendio ThinLinc contains an improper authentication vulnerability in its browser-based web client (tlwebaccess) that allows an authenticated attacker to impersonate any other user, including root, by exploiting flaws in multi-step authentication flows such as one-time passwords, login banners, or expired password prompts. Attackers can leverage this authentication bypass during the multi-step login process to gain unauthorized access to other user accounts, including administrative privileges, in versions from 4.1.0 through 4.20.0.
References
- https://community.thinlinc.com/t/thinlinc-4-15-1-through-4-20-1-security-release/1985
- https://community.thinlinc.com/t/urgent-thinlinc-security-issue/1970
- https://www.vulncheck.com/advisories/cendio-thinlinc-improper-authentication-via-web-acces
This high severity vulnerability with a CVSS score of 7.7 was published on 2026-11-05 via NVD.
vulnfeed aggregates 16740 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.