CVE-2026-12703 Bypass of 2FA for Connections via Unattended Access in TeamViewer for macOS
An authenticated attacker can bypass 2FA to establish remote connections on TeamViewer for macOS hosts.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-12703?
CVE-2026-12703 is a high-severity authentication bypass vulnerability in TeamViewer ONE, published on 29 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to bypass a configured 2FA for Connections approval flow via Unattended Access and establish a remote connection to an affected macOS host.
Weakness: CWE-288
Which versions are affected by CVE-2026-12703?
How do I fix CVE-2026-12703?
No fix has been published for CVE-2026-12703 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-12703 being exploited?
There is no known exploitation of CVE-2026-12703 in the wild and no public exploit code.
Sources
Also known as GHSA-r926-cxpx-jff4.