Threats tagged 'ghsa-5r8q-rp82-m3v2'

Cendio ThinLinc's browser-based web client (tlwebaccess) has an improper authentication vulnerability affecting versions 4.1.0 through 4.20.0. This flaw allows an authenticated attacker to impersonate any other user, including root, by exploiting weaknesses in multi-step authentication flows such as one-time passwords, login banners, or expired password prompts. The vulnerability enables unauthorized access to other user accounts, including those with administrative privileges.