Improper Authentication Vulnerability in Cendio ThinLinc Web Client
CVE-2026-119744

7.7HIGH

Key Information:

Vendor

Cendio

Status
Thinlinc
Vendor
CVE Published:
5 November 2026

What is CVE-2026-119744?

Cendio ThinLinc contains an improper authentication vulnerability within its browser-based web client. This flaw permits an authenticated attacker to impersonate any user, including those with administrative privileges. By exploiting weaknesses in multi-step authentication processes, such as one-time passwords and login prompts, attackers can bypass security measures. This poses a significant risk, as versions 4.1.0 through 4.20.0 are susceptible to unauthorized account access, potentially allowing attackers to control user accounts at various access levels.

Affected Version(s)

ThinLinc 4.1.0 < 4.15.1

ThinLinc 4.16.0 < 4.16.1

ThinLinc 4.17.0 < 4.17.1

References

https://community.thinlinc.com/t/thinlinc-4-15-1-through-...
release-notespatch
https://community.thinlinc.com/t/urgent-thinlinc-security...
vendor-advisory
https://www.vulncheck.com/advisories/cendio-thinlinc-impr...
third-party-advisory

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Cosmikal S.L.
.