Input validation in the Host Pass creation workflow allows an authenticated user with Host Pass creation privileges to specify a token expiration duration beyond the intended maximum when generating delegated access tokens. The result is that the user can create long‑lived delegation tokens that remain valid for longer than the system normally permits, potentially giving them continued access to the host even after normal revocation periods have passed. The privilege level required is already that of a Host Pass creator, so the attack is limited to the user’s existing access rights but can enable lingering presence or repeated unauthorized activities.

ConnectWise ScreenConnect on‑prem installations before version 26.2 are affected. In the Cloud deployment no action is required as the servers have already been updated.

The CVSS score of 4.7 indicates moderate severity. The exploit requires authentication and Host Pass creation rights, so it is a credential‑based attack that would be executed by a trusted user. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting low to moderate likelihood of exploitation at this time.