WireGuard Easy Vulnerability Allows Unauthorized Credential Recovery
A critical flaw in WireGuard Easy allows unauthenticated attackers to brute-force weak tokens and hijack VPN peer credentials.
WireGuard Easy versions up to 15.3.0 contain a critical vulnerability, tracked as CVE-2026-63089, involving cryptographically weak one-time link token generation. The issue stems from the use of CRC32 to compute tokens based on a limited range of random values, creating a small keyspace of only 1,000 possibilities per client ID.
Because the /cnf/:oneTimeLink route lacks rate limiting and does not properly validate token expiration, unauthenticated network attackers can brute-force these tokens to recover a peer's PrivateKey and PresharedKey. Successful exploitation allows an attacker to impersonate the compromised peer on the VPN network.
Users are advised to update to the version containing the fix identified in commit 66b292b to mitigate this risk.
Continue Reading
SecurityNewFormalizing the Vulnerability Lifecycle
International agencies are pushing software vendors to adopt standardized vulnerability disclosure frameworks for better security.
SecurityNewCritical Heap Corruption Flaw Discovered in illumos SCTP Stack
A critical vulnerability in the illumos SCTP inbound path allows unauthenticated remote attackers to trigger kernel heap corruption and potential code execution.
SecurityNewCISA Adds Fortinet FortiSandbox Command Injection Flaw to KEV Catalog
CISA has confirmed active exploitation of a command injection vulnerability in Fortinet FortiSandbox, mandating urgent remediation for federal agencies.