---
id: CVE-2026-92749
title: >-
  SafeLine through 9.4.1 derives the management console session-signing secret
  from a time-seeded math/rand generator, allowing attackers to reconstruct the
  key offline
summary: >-
  SafeLine through 9.4.1 derives the management console session-signing secret
  from a time-seeded math/rand generator, allowing attackers to reconstruct the
  key offline. Unauthenticated remote attackers who can bound the install
  timestamp …
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-338
vendor: chaitin
product: SafeLine
affected:
  - SafeLine <= 9.4.1
published: '2026-09-16'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:48.143'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92749'
references:
  - url: 'https://github.com/chaitin/SafeLine'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/chaitin/SafeLine/blob/v9.4.1/management/webserver/model/option.go#L27
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/chaitin/SafeLine/blob/v9.4.1/management/webserver/utils/random.go#L10-L17
    label: disclosure@vulncheck.com
  - url: 'https://github.com/chaitin/SafeLine/issues/1298'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/safeline-through-9.4.1-authentication-bypass-via-weak-session-secret
    label: disclosure@vulncheck.com
  - url: 'https://github.com/chaitin/SafeLine/issues/1298'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
epss: 0.00712
epssPercentile: 0.51524
ingestedAt: '2026-09-16T21:05:36.899Z'
---

## Overview

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator session cookies to gain control of protected sites.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.