CVE Watch16 jul 2026

CVE-2026-63089

WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that

CVSS

9.3

Crítico

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 16 jul 2026 · Última mod.: 16 jul 2026 · CWE-338 · CWE-613

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a keyspace of at most 1000 candidate tokens per client ID, as the token is computed using CRC32 over a random value constrained to 0-999. Attackers can enumerate candidate tokens against the unauthenticated /cnf/:oneTimeLink route, which lacks rate limiting and does not validate token expiration, to obtain a peer's PrivateKey and PresharedKey and impersonate that peer on the VPN network.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2022-255906.5 MED

66.7%

——20SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data using the browser cache when the user exits the application.8d CVE-2022-361799.8 CRÍ

56.7%

——17Fusiondirectory 1.3 suffers from Improper Session Handling.8d CVE-2026-615009.8 CRÍ

50.7%

——15Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.1d CVE-2022-415425.4 MED

45.3%

——14devhub 0.102.0 was discovered to contain a broken session control.8d CVE-2026-443837.5 ALT

43.0%

——13Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend.3d CVE-2022-346245.9 MED

40.3%

——12Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request.8d