CVE-2026-63089: WireGuard Easy Weak Token Generation Information Disclosure via OTL Route
WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a keyspace of at most 1000 candidate tokens per client ID, as the token is computed using CRC32 over a random value constrained to 0-999. Attackers can enumerate candidate tokens against the unauthenticated /cnf/:oneTimeLink route, which lacks rate limiting and does not validate token expiration, to obtain a peer's PrivateKey and PresharedKey and impersonate that peer on the VPN network.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WireGuard Easyto a version that resolves this vulnerability.Fixed in 15.3.0Patch 66b292b - Compensating control
Apply compensating network protection for the unauthenticated /cnf/:oneTimeLink route by preventing unauthenticated attackers from reaching/brute-forcing candidate one-time link tokens (e.g., restrict/limit exposure of that route at the network layer).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63089?
CVE-2026-63089 has a critical severity rating of 9.3.
How does CVE-2026-63089 affect WireGuard Easy users?
CVE-2026-63089 allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing weak one-time link tokens.
How can I fix CVE-2026-63089?
To fix CVE-2026-63089, users should update to WireGuard Easy version 15.4.0 or later, which contains the necessary patches.
What is the risk associated with CVE-2026-63089?
The risk associated with CVE-2026-63089 is rated at 61, indicating a significant threat to security.
What type of vulnerability is CVE-2026-63089 classified as?
CVE-2026-63089 is classified as a weak RNG (Random Number Generator) vulnerability.