# INFINITT ULite share-link passwords are brute-forceable; pre-auth XSS fixed in BN50 · pwn.watch

> INFINITT Healthcare advisory INFINITT-SA-2026-001 (Nov 5 2026) and NCSC.ch CVE records cover two issues in the ULite medical imaging universal viewer. CVE-2026-19877 (High, CVSS 3.1 7.5) lets an unauthenticated remote attacker brute-force the low-entropy password on image-share links with no attempt limiting, gaining unauthorized access to shared medical images within the link validity window on ULite 5.0.2.1_BN48_20260528 and earlier. CVE-2026-19876 (Medium, CVSS 6.1) is a pre-authentication reflected XSS on the login/SSO error page via an unsanitized request parameter. Both are fixed in ULite 5.0.2.1 BN50. INFINITT says there is no indication of exploitation and is deploying the update to customers under existing maintenance agreements; sites should schedule the BN50 update with INFINITT support.

Page: https://pwn.watch/i/infinitt-ulite-share-link-brute-force-xss-nov-2026 · generated 2026-11-06T11:58:06.152Z

## Status
- Severity: high · status: live · patch: patched
- Product: INFINITT ULite (universal medical image viewer)
- Started: 2026-11-05
- CVEs: CVE-2026-19877, CVE-2026-19876
- Affected: INFINITT ULite 5.0.2.1_BN48_20260528 and earlier
- Fixed in: INFINITT ULite 5.0.2.1 BN50 or later

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/infinitt-ulite-share-link-brute-force-xss-nov-2026/feed.xml
- JSON Feed: https://pwn.watch/i/infinitt-ulite-share-link-brute-force-xss-nov-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/infinitt-ulite-share-link-brute-force-xss-nov-2026.json
- This file: https://pwn.watch/i/infinitt-ulite-share-link-brute-force-xss-nov-2026/llms.txt

## Updates (newest first)
- 2026-11-06: NCSC.ch publishes CVE-2026-19877 (High, CVSS 7.5): unauthenticated brute-force of low-entropy image-share link passwords on ULite <= 5.0.2.1_BN48_20260528; and CVE-2026-19876 (Medium, CVSS 6.1): pre-auth reflected XSS on the login/SSO error page. Fixed in 5.0.2.1 BN50. (https://www.infinitt.com/upload/attach/202611/INFINITT-SA-2026-001-1.pdf)
- 2026-11-05: INFINITT Healthcare publishes INFINITT-SA-2026-001: security update for ULite share-link access control weakness and reflected XSS in the web interface; fixed builds BN50 deploying under maintenance agreements; no indication of exploitation. (https://www.infinitt.com/upload/attach/202611/INFINITT-SA-2026-001-1.pdf)

## Fix brief
# Security brief: INFINITT ULite share-link passwords are brute-forceable; pre-auth XSS fixed in BN50

Source: https://pwn.watch/i/infinitt-ulite-share-link-brute-force-xss-nov-2026 · status: live · severity: high · updated Nov 6, 2026, 09:49 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
INFINITT Healthcare advisory INFINITT-SA-2026-001 (Nov 5 2026) and NCSC.ch CVE records cover two issues in the ULite medical imaging universal viewer. CVE-2026-19877 (High, CVSS 3.1 7.5) lets an unauthenticated remote attacker brute-force the low-entropy password on image-share links with no attempt limiting, gaining unauthorized access to shared medical images within the link validity window on ULite 5.0.2.1_BN48_20260528 and earlier. CVE-2026-19876 (Medium, CVSS 6.1) is a pre-authentication reflected XSS on the login/SSO error page via an unsanitized request parameter. Both are fixed in ULite 5.0.2.1 BN50. INFINITT says there is no indication of exploitation and is deploying the update to customers under existing maintenance agreements; sites should schedule the BN50 update with INFINITT support.

Severity detail: CVE-2026-19877 CVSS 7.5 High unauthenticated share-link password brute-force exposing medical images; companion Medium pre-auth XSS CVE-2026-19876; no known exploitation

- Product: INFINITT ULite (universal medical image viewer)
- CVE / advisory ids: CVE-2026-19877, CVE-2026-19876

## Affected versions
- INFINITT ULite 5.0.2.1_BN48_20260528 and earlier

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- INFINITT ULite 5.0.2.1 BN50 or later

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Specific notes
Healthcare / PACS sites running INFINITT ULite: confirm BN50 or later with INFINITT support (vendor often deploys under maintenance agreements). Until patched, treat image-share links as sensitive and avoid long-lived or widely shared links. Never cite cve.now. Primary: INFINITT-SA-2026-001 PDF.

## Latest updates
- Nov 6, 2026: NCSC.ch publishes CVE-2026-19877 (High, CVSS 7.5): unauthenticated brute-force of low-entropy image-share link passwords on ULite <= 5.0.2.1_BN48_20260528; and CVE-2026-19876 (Medium, CVSS 6.1): pre-auth reflected XSS on the login/SSO error page. Fixed in 5.0.2.1 BN50.
- Nov 5, 2026: INFINITT Healthcare publishes INFINITT-SA-2026-001: security update for ULite share-link access control weakness and reflected XSS in the web interface; fixed builds BN50 deploying under maintenance agreements; no indication of exploitation.

## Advisories
- [INFINITT-SA-2026-001 — INFINITT ULite Security Update (Share-Link and Web Interface)](https://www.infinitt.com/upload/attach/202611/INFINITT-SA-2026-001-1.pdf) (INFINITT Healthcare)

---
Machine-readable: https://pwn.watch/i/infinitt-ulite-share-link-brute-force-xss-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.