Read the docs
TI-2026-55178 Aliases CVE-2026-79680GHSA-wc8f-vjgx-jxrw

Authentication bypass in qt

Priority LOW 21CWE-288Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-288.

Summary

Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modified VNC client that violates the RFB protocol can bypass Qt VNC Server's password authentication and gain unauthorized remote access to the shared application, compromising the confidentiality and integrity of the session.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00342 27th percentileScored 2026-11-07
Fix Fixed qt (qt): 6.8.9, 6.11.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
qtqt6.4.0 to before 6.8.9; 6.9.0 to before 6.11.36.8.9, 6.11.3Patch availableCNA
  • qt Vendorqt Affected 6.4.0 to before 6.8.9; 6.9.0 to before 6.11.3 Fixed in 6.8.9, 6.11.3 Patch available CNA

Remediation

  • Fix · CNA qt (qt) Fixed in 6.8.9, 6.11.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-79680
  2. 2026-10-03 Alias added: GHSA-wc8f-vjgx-jxrw

References

Patch 1

Other 1

  • TI-2024-23902 QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.13, 6.3.x… CVSS 3.1CRITICAL 9.8
  • TI-2022-21359 Heap-based buffer overflow in Qt CVSS 3.1HIGH 8.8
  • TI-2022-19524 Integer overflow in Qt CVSS 3.1HIGH 8.8
  • TI-2023-18997 In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can… CVSS 3.1HIGH 7.5
  • TI-2021-09305 Integer Overflow vulnerability in qsvghandler.cpp in Qt qtsvg versions 5.15.1, 6.0.0… CVSS 3.1MEDIUM 5.5
  • TI-2023-28356 An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before… CVSS 3.1CRITICAL 9.8
See all 106 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences