Vulnerability · Published Nov 5, 2026 · Assigned by VulnCheck

CVE-2026-119744Cendio ThinLinc Improper Authentication via Web Access

High 8.8

In plain English

A high-severity authentication bypass by spoofing in ThinLinc from Cendio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.4%top 61.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cendio ThinLinc contains an improper authentication vulnerability in its browser-based web client (tlwebaccess) that allows an authenticated attacker to impersonate any other user, including root, by exploiting flaws in multi-step authentication flows such as one-time passwords, login banners, or expired password prompts. Attackers can leverage this authentication bypass during the multi-step login process to gain unauthorized access to other user accounts, including administrative privileges, in versions from 4.1.0 through 4.20.0.

Affected products (as reported)

Vendor	Product	Versions
Cendio	ThinLinc	4.1.0 – before 4.15.14.16.0 – before 4.16.14.17.0 – before 4.17.14.18.0 – before 4.18.14.19.0 – before 4.19.14.20.0 – before 4.20.1

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

ThinLinc 4.15.1 through 4.20.1 security release release-notes, patch
Urgent: ThinLinc security issue vendor-advisory
VulnCheck Advisory: Cendio ThinLinc Improper Authentication via Web Access third-party-advisory