Back to overview

CVE-2026-63089

CRITICAL
9.3
CVSS 3.1
Description
WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a keyspace of at most 1000 candidate tokens per client ID, as the token is computed using CRC32 over a random value constrained to 0-999. Attackers can enumerate candidate tokens against the unauthenticated /cnf/:oneTimeLink route, which lacks rate limiting and does not validate token expiration, to obtain a peer's PrivateKey and PresharedKey and impersonate that peer on the VPN network.

Metadata

CVE ID
CVE-2026-63089
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-07-15 15:45 UTC
Published
2026-07-16 19:28 UTC
Last updated
2026-07-16 19:28 UTC
Primary CWE
CWE-338
Use of Cryptographically Weak Pseudo-Random Number Generator…
Vendor / Product
wg-easy / wg-easy
Sources
cve.org  ·  NVD

Severity & Metrics

9.3 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Affected products (1)
VendorProductPlatformVersions
wg-easy wg-easy — 0 ≤ 15.3.0, 66b292b11bde3664f05ffb016c8082665d261ded
Weakness (CWE)
CWESourceDescription
CWE-338 cna Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CWE-613 cna Insufficient Session Expiration
CVSS scores (2)
ScoreSeverityVersionSourceVector
9.3 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
9.0 CRITICAL 4.0 cna CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N
References (3)
Back to overview