WireGuard Easy Vulnerability Allows Unauthorized Credential Recovery
A critical flaw in WireGuard Easy allows unauthenticated attackers to brute-force weak tokens and hijack VPN peer credentials.
WireGuard Easy versions up to 15.3.0 contain a critical vulnerability, tracked as CVE-2026-63089, involving cryptographically weak one-time link token generation. The issue stems from the use of CRC32 to compute tokens based on a limited range of random values, creating a small keyspace of only 1,000 possibilities per client ID.
Because the /cnf/:oneTimeLink route lacks rate limiting and does not properly validate token expiration, unauthenticated network attackers can brute-force these tokens to recover a peer's PrivateKey and PresharedKey. Successful exploitation allows an attacker to impersonate the compromised peer on the VPN network.
Users are advised to update to the version containing the fix identified in commit 66b292b to mitigate this risk.
Sources
- GitHub Security Advisories Original source
Continue Reading
SecurityA hands-on way to gauge AI ransomware risk
OWASP volunteers released RAID-AI, a free manual self-assessment that maps AI controls to NIST and CISA frameworks.
SecurityAWS AgentCore Flaw Let One Prompt Hijack All Agents
Researchers say a single chat prompt could extract cloud credentials and let an attacker take over every AgentCore agent in an AWS account and region.
SecurityLightwell Uncovers 400+ Java Library Flaws
IBM and Red Hat's Lightwell project has identified over 400 novel vulnerabilities in Java libraries, launching a clearinghouse service for customers to submit code for review.