The flaw is an improper authentication issue in the browser‑based web client (tlwebaccess). An attacker who has already authenticated can exploit weaknesses in the multi‑step login flow—such as one‑time password handling, login banners, or expired password prompts—to masquerade as any other user, including super‑user accounts. Once impersonated, the attacker gains full access to the target account, allowing them to read, modify, or delete data and to perform administrative actions.

Cendio ThinLinc versions 4.1.0 through 4.20.0, as identified by the vendor, are affected.

The CVSS score of 7.7 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. An attacker must first authenticate, but they can then impersonate any user. The deficiency in the web client’s authentication flow offers a direct path to privilege escalation, and because the flaw targets web‑based access, it can be exercised from any network location that reaches the Thinlinc web interface.