{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3acendiothinlinc/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:cendio:thinlinc:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-119744"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-119744\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["ThinLinc (4.1.0 through 4.20.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Cendio"],"content_html":"\u003cp\u003eCendio ThinLinc versions 4.1.0 through 4.20.0 contain an improper authentication vulnerability in its browser-based web client (tlwebaccess). An authenticated attacker can impersonate any other user, including root, by exploiting flaws in multi-step authentication flows such as one-time passwords, login banners, or expired password prompts.\u003c/p\u003e\n","date_modified":"2026-11-05T16:32:11Z","date_published":"2026-11-05T16:21:01Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cendio-thinlinc-auth-bypass/","summary":"Cendio ThinLinc versions 4.1.0 through 4.20.0 contain an improper authentication vulnerability in the browser-based web client (tlwebaccess) that allows an authenticated attacker to impersonate other users, including root.","title":"Cendio ThinLinc: Improper authentication in web client (CVE-2026-119744)","url":"https://feed.craftedsignal.io/briefs/2026-11-cendio-thinlinc-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:cendio:thinlinc:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}