CVE WatchJul 16, 2026

CVE-2026-63089

WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that

CVSS

9.3

Critical

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Jul 16, 2026 · Last modified: Jul 16, 2026 · CWE-338 · CWE-613

EPSS · 30d

Not enough EPSS history yet.

Technical description

WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a keyspace of at most 1000 candidate tokens per client ID, as the token is computed using CRC32 over a random value constrained to 0-999. Attackers can enumerate candidate tokens against the unauthenticated /cnf/:oneTimeLink route, which lacks rate limiting and does not validate token expiration, to obtain a peer's PrivateKey and PresharedKey and impersonate that peer on the VPN network.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2022-255906.5 MED

66.7%

——20SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data using the browser cache when the user exits the application.8d CVE-2022-361799.8 CRI

56.7%

——17Fusiondirectory 1.3 suffers from Improper Session Handling.8d CVE-2026-615009.8 CRI

50.7%

——15Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.1d CVE-2022-415425.4 MED

45.3%

——14devhub 0.102.0 was discovered to contain a broken session control.8d CVE-2026-443837.5 HIG

43.0%

——13Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend.3d CVE-2022-346245.9 MED

40.3%

——12Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request.8d