CVE-2026-81576: Improper Authentication of Session Handles
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read license information belonging to another handle.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
CodeMeter Runtime deployments configured as a server are affected before version 8.41a and before version 9.10. The issue concerns session handles issued for server connections.
What does an attacker need to exploit this?
An attacker needs network access to the server and a low-privileged context, as reflected by the PR:L vector. No user interaction is required; the attacker brute-forces the weak SID to recover another session's handle number.
What information can be exposed?
An attacker who recovers another session's handle can read license information associated with that handle. The supplied impact data indicates high confidentiality impact, with no integrity or availability impact stated.