CVE-2026-63089
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
WireGuard Easy up to version 15.3.0 contains a vulnerability due to cryptographically weak one-time link token generation. The token is computed using CRC32 over a random value constrained to 0-999, allowing an unauthenticated attacker to recover WireGuard peer credentials by brute-forcing a keyspace of at most 1000 candidates per client ID.
Risk Assessment
An attacker can obtain a peer's PrivateKey and PresharedKey, impersonating that peer on the VPN network. The lack of rate limiting and token expiration validation on the /cnf/:oneTimeLink route enables effective exploitation.
Recommendation
Immediately update WireGuard Easy to a version containing commit 66b292b or later. Additionally, implement rate limiting on the /cnf/:oneTimeLink route and token expiration validation.
Original NVD description (English source)
WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a keyspace of at most 1000 candidate tokens per client ID, as the token is computed using CRC32 over a random value constrained to 0-999. Attackers can enumerate candidate tokens against the unauthenticated /cnf/:oneTimeLink route, which lacks rate limiting and does not validate token expiration, to obtain a peer's PrivateKey and PresharedKey and impersonate that peer on the VPN network.