CVE-2026-12703 in Full Client and Host
Summary
by MITRE • 07/29/2026
TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to bypass a configured 2FA for Connections approval flow via Unattended Access and establish a remote connection to an affected macOS host.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
This vulnerability represents a critical business logic flaw in TeamViewer's authentication mechanism for macOS clients and hosts prior to version 15.80. The issue stems from improper validation of the two-factor authentication process within the connection approval workflow, specifically affecting unattended access scenarios where remote connections are established without direct user presence at the target system. The flaw allows authenticated attackers to circumvent the configured 2FA requirements by exploiting a gap in the approval flow logic that governs how connection requests are processed and validated.
The technical implementation of this vulnerability involves a misconfiguration in the authorization validation sequence where the system fails to properly enforce multi-factor authentication controls during the unattended access connection establishment process. When an attacker has legitimate access credentials and can manipulate the connection approval flow, they can bypass the required second factor authentication that should normally be enforced before granting remote access privileges. This business logic error creates an unintended pathway where the system's security controls are effectively neutralized during specific operational scenarios involving unattended connections.
The operational impact of this vulnerability is significant as it undermines the fundamental security model designed to protect macOS systems from unauthorized remote access. Attackers can establish persistent remote connections without proper authentication verification, potentially leading to full system compromise, data exfiltration, and lateral movement within network environments. The vulnerability particularly affects organizations that rely on TeamViewer for remote management and support, as it allows malicious actors to gain access to systems even when administrators have configured additional security controls like 2FA.
This issue aligns with CWE-613 which addresses inadequate authentication mechanisms and represents a failure in the proper enforcement of security controls during authentication flows. The vulnerability also maps to ATT&CK technique T1078 which covers valid accounts and privilege escalation through legitimate credentials, as attackers can leverage authenticated sessions to bypass additional security layers. Organizations should immediately implement mitigation strategies including mandatory updates to TeamViewer version 15.80 or later, review of existing 2FA configurations, and enhanced monitoring of connection approval activities. Additional protective measures include implementing network segmentation controls, limiting TeamViewer access to trusted networks, and conducting comprehensive security audits of remote access procedures to identify potential exploitation vectors.