{"id":"CVE-2026-63089","title":"WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a…","summary":"WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a…","severity":"critical","cvss":9.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","cwe":["CWE-338","CWE-613"],"published":"2026-07-16","updated":"2026-07-18","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63089","references":[{"url":"https://github.com/wg-easy/wg-easy/commit/66b292b11bde3664f05ffb016c8082665d261ded","label":"disclosure@vulncheck.com"},{"url":"https://github.com/wg-easy/wg-easy/pull/2661","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/wireguard-easy-weak-token-generation-information-disclosure-via-otl-route","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"epss":0.00414,"epssPercentile":0.35305,"ingestedAt":"2026-07-18T20:24:54.565Z","slug":"CVE-2026-63089","body":"## Overview\n\nWireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a keyspace of at most 1000 candidate tokens per client ID, as the token is computed using CRC32 over a random value constrained to 0-999. Attackers can enumerate candidate tokens against the unauthenticated /cnf/:oneTimeLink route, which lacks rate limiting and does not validate token expiration, to obtain a peer's PrivateKey and PresharedKey and impersonate that peer on the VPN network.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":51.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}