CVE-2026-92749: SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret
SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator session cookies to gain control of protected sites.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SafeLineto a version that resolves this vulnerability.Fixed in 9.4.1
Event History
Frequently Asked Questions
What conditions must an attacker meet to exploit this issue?
An attacker does not need authentication or user interaction, but must be able to bound the SafeLine installation timestamp. With that information, they can reconstruct the session-signing secret offline and forge an administrator session cookie.
What access could a successful attacker obtain?
A successful attacker can create valid administrator sessions for the management console. This can give them control of protected sites.
How can I determine whether my deployment is affected?
Deployments running SafeLine through 9.4.1 are affected according to the available information. The issue concerns the management console's session-signing secret generation, so systems with an exposed or reachable management console should be prioritized for review.