CVE-2026-11596: ScreenConnect Host Pass Token Expiration Bypass (MEDIUM, 4.7)

Technical summary

The vulnerability stems from insufficient input validation in the Host Pass creation functionality. The flaw permits authenticated users holding Host Pass creation permissions to circumvent controls on token expiration duration. By specifying an expiration value beyond the designed maximum threshold, an attacker with adequate privileges can generate delegated access tokens with extended validity windows. This affects ScreenConnect versions prior to 26.2. The issue is classified under CWE-1284 (Improper Validation of Specified Quantity in Input), indicating that the application fails to properly constrain the duration parameter to its intended bounds.

Business impact

This vulnerability creates insider risk and privilege-escalation exposure. If a privileged user—such as an IT administrator or support engineer—creates Host Pass tokens with extended expiration windows, those tokens remain valid longer than organizational access policies permit. This extends the window for token misuse, interception, or unauthorized delegation. In environments where Host Pass tokens are shared or cached, longer validity periods increase the likelihood that a compromised or stolen token will remain exploitable. The impact depends on whether affected tokens grant access to sensitive systems or customer environments.

Affected systems

ScreenConnect versions prior to 26.2 are affected. Organizations should check their current deployment version immediately. The vendor has not indicated broader impact across different product lines or platform variants based on available information.

Exploitability

Exploitation requires that an attacker already possess valid credentials and explicit Host Pass creation privileges—a relatively high barrier. The attack does not require user interaction or network-level complexity; once authenticated, the attacker can simply craft a token creation request with an out-of-bounds expiration parameter. The ease of execution is moderate once authentication is obtained. No public exploits have been designated for active exploitation at this time.

Remediation

Organizations running ScreenConnect should upgrade to version 26.2 or later, which includes corrected input validation for Host Pass token creation. Pending patching, consider restricting Host Pass creation privileges to only essential personnel and implementing additional monitoring or audit logging for token creation events to detect unusual expiration values.

Patch guidance

Upgrade ScreenConnect to version 26.2 or later. Verify patch deployment by checking the application version in the administrative console or via vendor-supplied verification tools. Test the upgrade in a non-production environment first to confirm compatibility with your deployment. Once patched, validate that Host Pass token creation now properly enforces expiration duration limits and rejects out-of-bounds values.

Detection guidance

Monitor ScreenConnect audit logs for Host Pass token creation events that specify unusually long expiration durations. Compare the requested expiration value against your organization's policy maximum and flag anomalies. Examine existing tokens in your ScreenConnect environment and verify their expiration dates align with issued policies—tokens with far-future expiration dates may indicate prior exploitation. Look for Host Pass creation requests from privileged accounts during unusual hours or from unexpected sources as a behavioral indicator.

Why prioritize this

This vulnerability warrants priority patching despite its medium CVSS score because it directly affects access control and token longevity—core security mechanisms in remote support scenarios. The authenticated nature of the attack reduces immediate external risk, but the privileged context means internal threats or compromised administrative accounts can cause harm with extended impact. Organizations managing customer access via ScreenConnect should treat this as higher priority than the base score alone suggests.

Risk score, explained

The CVSS 3.1 score of 4.7 (MEDIUM) reflects a vulnerability requiring high-level privileges to exploit (PR:H) with no user interaction needed (UI:N). The impact is limited to confidentiality, integrity, and availability at a low level (each scored L), and the scope is unchanged (S:U). The score appropriately captures that this is not a critical remote code execution flaw, but rather a boundary-condition control bypass that requires existing privileged access. However, the extended token validity risk and potential for privilege persistence justify treating it as higher priority in practice, particularly in managed service or customer-facing deployments.

Frequently asked questions