Vulnerability · Published Jul 16, 2026 · Assigned by VulnCheck

CVE-2026-63089WireGuard Easy Weak Token Generation Information Disclosure via OTL Route

Critical 9.3

In plain English

A critical-severity security flaw in wg-easy from wg-easy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)9.3Critical

Exploit odds (30 days)0.4%top 64.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a keyspace of at most 1000 candidate tokens per client ID, as the token is computed using CRC32 over a random value constrained to 0-999. Attackers can enumerate candidate tokens against the unauthenticated /cnf/:oneTimeLink route, which lacks rate limiting and does not validate token expiration, to obtain a peer's PrivateKey and PresharedKey and impersonate that peer on the VPN network.

Affected products (as reported)

Vendor	Product	Versions
wg-easy	wg-easy	0 – through 15.3.0

Weakness: CWE-338, CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

References

Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/wireguard-easy-weak-token-generation-information-disclosure-via-otl-route third-party-advisory