{"id":"CVE-2026-119744","published":"2026-11-05T15:17:20.557","lastModified":"2026-11-05T17:17:56.500","description":"Cendio ThinLinc contains an improper authentication vulnerability in its browser-based web client (tlwebaccess) that allows an authenticated attacker to impersonate any other user, including root, by exploiting flaws in multi-step authentication flows such as one-time passwords, login banners, or expired password prompts. Attackers can leverage this authentication bypass during the multi-step login process to gain unauthorized access to other user accounts, including administrative privileges, in versions from 4.1.0 through 4.20.0.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-290"],"vendors":[],"products":[],"references":[{"url":"https://community.thinlinc.com/t/thinlinc-4-15-1-through-4-20-1-security-release/1985","tags":[]},{"url":"https://community.thinlinc.com/t/urgent-thinlinc-security-issue/1970","tags":[]},{"url":"https://www.vulncheck.com/advisories/cendio-thinlinc-improper-authentication-via-web-access","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Cendio ThinLinc's tlwebaccess web client has a multi-step authentication bypass (CWE-290) that lets authenticated attackers impersonate any user—including root—by exploiting flaws in flows like OTP, login banners, or expired password prompts.","exploitability":"Requires valid credentials for the vulnerable account and exploitation during the multi-step login process; low difficulty for an insider with minimal privilege escalation potential.","blast_radius":"An attacker can fully compromise any target user account—including administrative ones—leading to complete confidentiality, integrity, and availability loss across the ThinLinc environment.","remediation":"Upgrade to ThinLinc version 4.21.0 or later, which contains the vendor-provided fix for this authentication bypass.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","impersonation","web-client","multi-factor-auth-flaw"],"model":"garnet-coder","analyzedAt":"2026-11-06T09:53:23.852Z"}}