CVE-2002-1336
TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows...
TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users.
Exploit likelihood
What each source reports
NVD Score used
TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users.
- Record
CVE-2002-1336- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users.
- Record
CVE-2002-1336- Updated
- 2026-11-02
EUVDEUVD-2002-1320 No score
TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users.
- Record
EUVD-2002-1320- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fcjm-23wr-m9g6 No score
TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows...
TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users.
- Record
GHSA-fcjm-23wr-m9g6- Updated
- 2026-11-02
OSV No score
TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users.
- Record
CVE-2002-1336- Updated
- 2026-11-02
OSVDEBIAN-CVE-2002-1336 No score
TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users.
- Record
DEBIAN-CVE-2002-1336- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2002-1336 is a high vulnerability (CVSS 7.5) in Tightvnc, published December 11, 2002. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.40%, the 84th percentile. Fixed in tightvnc 1.2.6-1.