CVE-2026-119744
Description
A flaw was found in ThinLinc. The browser-based web client fails to properly validate authentication state during multi-step login procedures, such as one-time password prompts or login notices. An authenticated attacker can exploit this flaw to bypass authentication controls and impersonate any user, allowing them to gain unauthorized administrative access to the system.
Statement
This vulnerability is rated as having Important severity because a low-privileged authenticated attacker can hijack arbitrary active sessions and gain root-level administrative access, resulting in a severe compromise of host confidentiality and integrity. The risk is constrained to Important rather than Critical because successful exploitation requires valid existing credentials to initiate the session, preventing unauthenticated remote execution. Additionally, ThinLinc is a third-party remote desktop solution that is not shipped or supported in Red Hat Enterprise Linux or other Red Hat products.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce session state validation and user identity consistency across multi-step login boundaries in ThinLinc Web Access (tlwebaccess): upgrade to ThinLinc 4.15.1 through 4.20.1, which validate authentication state and user identity consistency across multi-step login procedures, closing all 3 injection vectors (one-time password prompt spoofing, login banner step manipulation, expired password reset flow hijacking). Until patched, this is a concern on Linux hosts running ThinLinc Web Access (tlwebaccess) with multi-step authentication enabled, so Disable the tlwebaccess service across cluster hosts, restrict access strictly to trusted users, and avoid multi-step login workflows such as OTP prompts, login banners, or expired password resets. As a compensating measure, Configure auditd to record user authentication, session creation, and UID transitions to detect impersonation, Run SELinux in enforcing mode to restrict unauthorized actions attempted by an impersonated session, Apply SELinux confined user mappings to constrain effective privileges and system access of logged-in accounts, Deploy EDR agents to detect anomalous root process execution and unauthorized post-exploitation activity, Monitor kernel syscalls via Falco or eBPF runtime security to detect unexpected root shells spawned by the web access service, and Integrate administrative session initiation and authentication events into SIEM to detect unauthorized access. These controls limit blast radius and contain exploitation, but they do not fix the underlying multi-step authentication state validation defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)
Understanding the Weakness (CWE)
Other
Technical Impact: Alter Execution Logic; Unexpected State
By performing actions in an unexpected order, or by omitting steps, an attacker could manipulate the business logic of the product or cause it to enter an invalid state. In some cases, this can also expose resultant weaknesses with security implications.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
