by Kastro
Paper/Archive/CVE-2026-63089

CVE-2026-63089

wg-easy wg-easy — WireGuard Easy Weak Token Generation Information Disclosure via OTL Route

EPSS 0.4%CVSS 9.3
critical.is priorityof 100
35
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 35.8.358 × 207.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a keyspace of at most 1000 candidate tokens per client ID, as the token is computed using CRC32 over a random value constrained to 0-999. Attackers can enumerate candidate tokens against the unauthenticated /cnf/:oneTimeLink route, which lacks rate limiting and does not validate token expiration, to obtain a peer's PrivateKey and PresharedKey and impersonate that peer on the VPN network.

Affected

ProductAffectedFixed inSource
wg-easy≤ 15.3.066b292b11bde3664f05ffb016c8082665d261dedCNA

Scores by source

VulnCheck (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
VulnCheck (CNA)9.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/wg-easy/wg-easy/pull/2661patchgithub.com/wg-easy/wg-easy/commit/66b292b11bde3664f05ffb016c8082665d261dedwriteupvulncheck.com/advisories/wireguard-easy-weak-token-generation-information-disclosure-via-otl-route