CVE-2022-36436

OSU Open Source Lab VNCAuthProxy through 1.1.1 is affected by an vncap/vnc/protocol.py VNCServerAuthenticator authentication-bypass vulnerability that could allow a malicious actor to gain unauthorized access to a VNC session or to disconnect a legitimate user from a VNC session. A remote attacker with network access to the proxy server could leverage this vulnerability to connect to VNC servers protected by the proxy server without providing any authentication credentials. Exploitation of this issue requires that the proxy server is currently accepting connections for the target VNC server.

• CWE-287
• CWE-287

• https://cert.grnet.gr/en/blog/cve-2022-36436-twisted-vnc-authentication-proxy-authentication-bypass/Exploit, Patch
• https://github.com/osuosl/twisted_vncauthproxy/commit/edc149af29242178091b2d6fcd42c3ef0851644bPatch
• https://github.com/osuosl/twisted_vncauthproxy/tree/release/1.1.1Release Notes
• https://pypi.org/project/VNCAuthProxy/Product
• https://cert.grnet.gr/en/blog/cve-2022-36436-twisted-vnc-authentication-proxy-authentication-bypass/Exploit, Patch
• https://github.com/osuosl/twisted_vncauthproxy/commit/edc149af29242178091b2d6fcd42c3ef0851644bPatch
• https://github.com/osuosl/twisted_vncauthproxy/tree/release/1.1.1Release Notes
• https://pypi.org/project/VNCAuthProxy/Product

Published

Sep 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36428Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in S…4.8
• CVE-2022-36429A command execution vulnerability exists in the ubus backend…7.2
• CVE-2022-3643Guests can trigger NIC interface reset/abort/crash via netba…6.5
• CVE-2022-36431An arbitrary file upload vulnerability in Rocket TRUfusion E…9.8
• CVE-2022-36432The Preview functionality in the Amasty Blog Pro 2.10.3 plug…5.4
• CVE-2022-36433The blog-post creation functionality in the Amasty Blog Pro …6.1
• CVE-2022-36437The Connection handler in Hazelcast and Hazelcast Jet allows…9.1
• CVE-2022-36438AsusSwitch.exe on ASUS personal computers (running Windows) …7.8
• CVE-2022-36439AsusSoftwareManager.exe in ASUS System Control Interface on …6
• CVE-2022-3644The collection remote for pulp_ansible stores tokens in plai…5.5
• CVE-2022-36440A reachable assertion was found in Frrouting frr-bgpd 8.3.0 …7.5
• CVE-2022-36441An issue was discovered in Zebra Enterprise Home Screen 4.1.…7.1