Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.0
CVE-2026-63089: WireGuard Easy Weak Token Generation Exposes VPN Credentials
CVE-2026-63089 · published 2 months ago
Summary
WireGuard Easy, a VPN software, allows attackers to guess weak tokens and gain access to VPN credentials. This vulnerability affects users who rely on WireGuard Easy for secure VPN connections. To stay secure, update to the latest version of WireGuard Easy.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wg-easy | wg-easy | <= 15.3.0 |
Original advisory text
WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireG...
WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a keyspace of at most 1000 candidate tokens per client ID, as the token is computed using CRC32 over a random value constrained to 0-999. Attackers can enumerate candidate tokens against the unauthenticated /cnf/:oneTimeLink route, which lacks rate limiting and does not validate token expiration, to obtain a peer's PrivateKey and PresharedKey and impersonate that peer on the VPN network.
References
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
9.0
Critical
Type
CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CWE-613Insufficient Session Expiration
Timeline
Published16 Jul 2026
Updated3 Oct 2026
First seen16 Jul 2026
Track software like this
Free during beta