Vulnerability · Published Apr 8, 2026 · Assigned by GitHub_M
CVE-2026-39880Remnawave Backend has a race condition in HWID device limit allows bypassing max devices
Medium 5.0
In plain English
A medium-severity race condition in backend from remnawave. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.2%top 91.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Remnawave Backend is the backend for the Remnawave proxy and user management solution. Prior to 2.7.5, a glitch in the HWID device registration logic allows an authenticated user to bypass the configured limit for HWID devices and register more devices than expected, allowing them to resell subscriptions and consume excessive traffic. This vulnerability is fixed in 2.7.5.
Affected products (as reported)
Weakness: CWE-362 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
References
- https://github.com/remnawave/backend/security/advisories/GHSA-985p-44h5-v3pq x_refsource_CONFIRM