Cendio ThinLinc Improper Authentication via Web Access
Affects ThinLinc Web Access (tlwebaccess) in releases 4.1.0 through 4.20.0 before the fixed 4.15.1, 4.16.1, 4.17.1, 4.18.1, 4.19.1 and 4.20.1 releases, in setups using multi-step login.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 4.15.1, 4.16.1, 4.17.1, 4.18.1, 4.19.1, and 1 more
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Affects the ThinLinc browser-based web client, Web Access (tlwebaccess). Requires a multi-step authentication flow, such as one-time passwords, a login banner, or an expired password prompt. Single-step username and password login is not sufficient. Affected versions include ThinLinc 4.1.0 up to, but not including, 4.15.1, and later ranges up to 4.20.0.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 17/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Cendio ThinLinc's browser-based web client (tlwebaccess) has an improper authentication flaw that lets a logged-in attacker impersonate other users, including root, by abusing multi-step login flows such as one-time passwords, login banners, or expired password prompts. The attack can be carried out remotely over the network, and it requires only a low-privilege login and no action from the victim.
Read the original description
Cendio ThinLinc contains an improper authentication vulnerability in its browser-based web client (tlwebaccess) that allows an authenticated attacker to impersonate any other user, including root, by exploiting flaws in multi-step authentication flows such as one-time passwords, login banners, or expired password prompts. Attackers can leverage this authentication bypass during the multi-step login process to gain unauthorized access to other user accounts, including administrative privileges, in versions from 4.1.0 through 4.20.0.
cve.now Index
- Exploitation0/40No signal
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.7/10CVSS 7.7, total technical impact per CISA
- No patch0/5No signal
What would change the score
- Would score about 67 if added to CISA KEV
- Would score about 62 if CISA's SSVC rates exploitation active
- Would score about 24 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Affects the ThinLinc browser-based web client, Web Access (tlwebaccess). Requires a multi-step authentication flow, such as one-time passwords, a login banner, or an expired password prompt. Single-step username and password login is not sufficient. Affected versions include ThinLinc 4.1.0 up to, but not including, 4.15.1, and later ranges up to 4.20.0.Upgrade to a fixed version: 4.15.1, 4.16.1, 4.17.1, 4.18.1, 4.19.1, or one of 1 more.
Workaround: Disable the ThinLinc Web Access service (tlwebaccess.service) until the system is upgraded.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Cendio ThinLinc
From 4.1.0 · fixed in 4.15.1; From 4.16.0 · fixed in 4.16.1; From 4.17.0 · fixed in 4.17.1; From 4.18.0 · fixed in 4.18.1; From 4.19.0 · fixed in 4.19.1; From 4.20.0 · fixed in 4.20.1
Evidence 3
- Advisory
- Patch
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-119744
Is CVE-2026-119744 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
Improper Authentication via Web Access means the browser-based ThinLinc client does not authenticate users correctly when a multi-step login flow is used.Source: community.thinlinc.com, vulncheck.com
Which versions are affected by CVE-2026-119744?
ThinLinc: from 4.1.0 before 4.15.1; from 4.16.0 before 4.16.1; from 4.17.0 before 4.17.1; from 4.18.0 before 4.18.1; from 4.19.0 before 4.19.1; from 4.20.0 before 4.20.1.Source: cve.now feed data
Am I affected, and how do I check?
Affected versions are ThinLinc 4.1.0 up to 4.15.1 and later ranges up to 4.20.0, excluding the fixed releases. Only setups with a multi-step flow, such as one-time passwords, a login banner, or an expired password prompt, are in scope; single-step username and password login is not sufficient. Check the installed ThinLinc version and whether the tlwebaccess.service is in use.Source: community.thinlinc.com, vulncheck.com
How do I fix CVE-2026-119744?
Upgrade to the fixed release for your branch: 4.15.1, 4.16.1, 4.17.1, 4.18.1, 4.19.1, or 4.20.1. Until the upgrade is done, the advisory's workaround is to disable the ThinLinc Web Access service (tlwebaccess.service).Source: community.thinlinc.com, vulncheck.com