PT-2026-31444 · Unknown · Remnawave Backend

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-39880

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Remnawave Backend versions prior to 2.7.5

Description A flaw exists in the HWID device registration logic of Remnawave Backend prior to version 2.7.5. An authenticated user can circumvent the configured limit for registered HWID devices, enabling them to register more devices than permitted. This could lead to unauthorized resale of subscriptions and excessive traffic consumption.

Recommendations Update to version 2.7.5 or later.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-39880

Affected Products

Remnawave Backend

References · 3

• https://github.com/remnawave/backend/security/advisories/GHSA-985p-44h5-v3pq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39880 · Security Note
• https://twitter.com/VulmonFeeds/status/2041980627298161087 · Twitter Post