INFINITT ULite share-link passwords are brute-forceable; pre-auth XSS fixed in BN50
INFINITT ULite (universal medical image viewer)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
INFINITT Healthcare advisory INFINITT-SA-2026-001 (Nov 5 2026) and NCSC.ch CVE records cover two issues in the ULite medical imaging universal viewer. CVE-2026-19877 (High, CVSS 3.1 7.5) lets an unauthenticated remote attacker brute-force the low-entropy password on image-share links with no attempt limiting, gaining unauthorized access to shared medical images within the link validity window on ULite 5.0.2.1_BN48_20260528 and earlier. CVE-2026-19876 (Medium, CVSS 6.1) is a pre-authentication reflected XSS on the login/SSO error page via an unsanitized request parameter. Both are fixed in ULite 5.0.2.1 BN50. INFINITT says there is no indication of exploitation and is deploying the update to customers under existing maintenance agreements; sites should schedule the BN50 update with INFINITT support.
Why this severity: CVE-2026-19877 CVSS 7.5 High unauthenticated share-link password brute-force exposing medical images; companion Medium pre-auth XSS CVE-2026-19876; no known exploitation
- Started
- Nov 5, 2026
Affected
- INFINITT ULite 5.0.2.1_BN48_20260528 and earlier
Fixed in
- INFINITT ULite 5.0.2.1 BN50 or later
Timeline2
NCSC.ch publishes CVE-2026-19877 (High, CVSS 7.5): unauthenticated brute-force of low-entropy image-share link passwords on ULite <= 5.0.2.1_BN48_20260528; and CVE-2026-19876 (Medium, CVSS 6.1): pre-auth reflected XSS on the login/SSO error page. Fixed in 5.0.2.1 BN50.
INFINITT Healthcare publishes INFINITT-SA-2026-001: security update for ULite share-link access control weakness and reflected XSS in the web interface; fixed builds BN50 deploying under maintenance agreements; no indication of exploitation.
Advisories1
Get an email when a new major security incident drops. No spam, unsubscribe any time.
