CVE-2026-18451 describes a vulnerability in the HTML5 KVM-over-IP console authentication mechanism where session tokens returned by the web interface can be guessed due to weaknesses in token generation. This could allow an attacker to take control of an active KVM session. The vulnerability has a low CVSS score of 3.1, indicating limited impact and exploitability.