PT-2026-60569 · Wg Easy · Wg-Easy

George Chen · CVE-2026-63089 · Published 2026-07-16 · Updated 2026-07-16

NVD

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a keyspace of at most 1000 candidate tokens per client ID, as the token is computed using CRC32 over a random value constrained to 0-999. Attackers can enumerate candidate tokens against the unauthenticated /cnf/:oneTimeLink route, which lacks rate limiting and does not validate token expiration, to obtain a peer's PrivateKey and PresharedKey and impersonate that peer on the VPN network.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

CWE-338

Related Identifiers

CVE-2026-63089

Affected Products

Wg-Easy

References · 4

• https://github.com/wg-easy/wg-easy/commit/66b292b11bde3664f05ffb016c8082665d261ded · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-63089 · Security Note
• https://github.com/wg-easy/wg-easy/pull/2661 · Note
• https://vulncheck.com/advisories/wireguard-easy-weak-token-generation-information-disclosure-via-otl-route · Note