{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "INFINITT ULite share-link passwords are brute-forceable; pre-auth XSS fixed in BN50 · updates",
  "home_page_url": "https://pwn.watch/i/infinitt-ulite-share-link-brute-force-xss-nov-2026",
  "feed_url": "https://pwn.watch/i/infinitt-ulite-share-link-brute-force-xss-nov-2026/feed.json",
  "description": "INFINITT Healthcare advisory INFINITT-SA-2026-001 (Nov 5 2026) and NCSC.ch CVE records cover two issues in the ULite medical imaging universal viewer. CVE-2026-19877 (High, CVSS 3.1 7.5) lets an unauthenticated remote attacker brute-force the low-entropy password on image-share links with no attempt limiting, gaining unauthorized access to shared medical images within the link validity window on ULite 5.0.2.1_BN48_20260528 and earlier. CVE-2026-19876 (Medium, CVSS 6.1) is a pre-authentication reflected XSS on the login/SSO error page via an unsanitized request parameter. Both are fixed in ULite 5.0.2.1 BN50. INFINITT says there is no indication of exploitation and is deploying the update to customers under existing maintenance agreements; sites should schedule the BN50 update with INFINITT support.",
  "language": "en",
  "_pwn": {
    "slug": "infinitt-ulite-share-link-brute-force-xss-nov-2026",
    "severity": "high",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/infinitt-ulite-share-link-brute-force-xss-nov-2026/feed.xml",
    "llms": "https://pwn.watch/i/infinitt-ulite-share-link-brute-force-xss-nov-2026/llms.txt",
    "json": "https://pwn.watch/i/infinitt-ulite-share-link-brute-force-xss-nov-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/infinitt-ulite-share-link-brute-force-xss-nov-2026#2026-11-06-b5b47e03",
      "url": "https://pwn.watch/i/infinitt-ulite-share-link-brute-force-xss-nov-2026#2026-11-06-b5b47e03",
      "title": "INFINITT ULite share-link passwords are brute-forceable; pre-auth XSS fixed in BN50: NCSC.ch publishes CVE-2026-19877 (High, CVSS 7.5): unauthenticated brute-force of low-entropy image-share link passwords on ULite <= 5.0.2.1_BN48_20260528; and CVE-2026-19876 (Medium, CVSS 6.1): pre-auth reflected XSS on the login/SSO error page. Fixed in 5.0.2.1 BN50.",
      "content_text": "INFINITT ULite share-link passwords are brute-forceable; pre-auth XSS fixed in BN50: NCSC.ch publishes CVE-2026-19877 (High, CVSS 7.5): unauthenticated brute-force of low-entropy image-share link passwords on ULite <= 5.0.2.1_BN48_20260528; and CVE-2026-19876 (Medium, CVSS 6.1): pre-auth reflected XSS on the login/SSO error page. Fixed in 5.0.2.1 BN50.\n\nSource: https://www.infinitt.com/upload/attach/202611/INFINITT-SA-2026-001-1.pdf",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://www.infinitt.com/upload/attach/202611/INFINITT-SA-2026-001-1.pdf",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/infinitt-ulite-share-link-brute-force-xss-nov-2026#2026-11-05-3b25e7e6",
      "url": "https://pwn.watch/i/infinitt-ulite-share-link-brute-force-xss-nov-2026#2026-11-05-3b25e7e6",
      "title": "INFINITT ULite share-link passwords are brute-forceable; pre-auth XSS fixed in BN50: INFINITT Healthcare publishes INFINITT-SA-2026-001: security update for ULite share-link access control weakness and reflected XSS in the web interface; fixed builds BN50 deploying under maintenance agreements; no indication of exploitation.",
      "content_text": "INFINITT ULite share-link passwords are brute-forceable; pre-auth XSS fixed in BN50: INFINITT Healthcare publishes INFINITT-SA-2026-001: security update for ULite share-link access control weakness and reflected XSS in the web interface; fixed builds BN50 deploying under maintenance agreements; no indication of exploitation.\n\nSource: https://www.infinitt.com/upload/attach/202611/INFINITT-SA-2026-001-1.pdf",
      "date_published": "2026-11-05T00:00:00.000Z",
      "external_url": "https://www.infinitt.com/upload/attach/202611/INFINITT-SA-2026-001-1.pdf",
      "tags": [
        "high"
      ]
    }
  ]
}