CVE-2026-119744

Summary

Cendio ThinLinc's tlwebaccess web client has a multi-step authentication bypass (CWE-290) that lets authenticated attackers impersonate any user—including root—by exploiting flaws in flows like OTP, login banners, or expired password prompts.

Exploitability

Requires valid credentials for the vulnerable account and exploitation during the multi-step login process; low difficulty for an insider with minimal privilege escalation potential.

Blast radius

An attacker can fully compromise any target user account—including administrative ones—leading to complete confidentiality, integrity, and availability loss across the ThinLinc environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to ThinLinc version 4.21.0 or later, which contains the vendor-provided fix for this authentication bypass.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.