Cendio ThinLinc: Improper authentication in web client (CVE-2026-119744)
Cendio ThinLinc versions 4.1.0 through 4.20.0 contain an improper authentication vulnerability in the browser-based web client (tlwebaccess) that allows an authenticated attacker to impersonate other users, including root.
CVE search metadata
CVE search record: CVE-2026-119744. Severity: high. CVSS: 8.8. KEV: no. Product: ThinLinc (4.1.0 through 4.20.0). Brief: Cendio ThinLinc: Improper authentication in web client (CVE-2026-119744). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cendio-thinlinc-auth-bypass/
Triage facts
Revision 2- Applicability
- ThinLinc (4.1.0 through 4.20.0)
- Evidence
- Unknown
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 2Nov 5, 16:33 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: claim_state, has_poc, lastmod, poc_references, references, updates
Sources: 1
Cendio ThinLinc versions 4.1.0 through 4.20.0 contain an improper authentication vulnerability in its browser-based web client (tlwebaccess). An authenticated attacker can impersonate any other user, including root, by exploiting flaws in multi-step authentication flows such as one-time passwords, login banners, or expired password prompts.