CVE-2026-63089 Details
Description
WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a keyspace of at most 1000 candidate tokens per client ID, as the token is computed using CRC32 over a random value constrained to 0-999. Attackers can enumerate candidate tokens against the unauthenticated /cnf/:oneTimeLink route, which lacks rate limiting and does not validate token expiration, to obtain a peer's PrivateKey and PresharedKey and impersonate that peer on the VPN network.
A vulnerability exists in WireGuard Easy versions through 15.3.0, related to the generation of one-time link tokens. The vulnerability allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a limited keyspace of up to 1000 candidate tokens per client ID. The token generation method uses CRC32 over a random value restricted to the range of 0-999, creating a predictable token generation process. Attackers can exploit this vulnerability by enumerating candidate tokens against the unauthenticated '/cnf/:oneTimeLink' route, which lacks rate limiting and does not properly validate token expiration. Successfully exploiting this vulnerability allows attackers to obtain a peer's PrivateKey and PresharedKey, enabling them to impersonate that peer on the VPN network.
Users can update to WireGuard Easy version 15.3.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 16, 2026CISA-ADP
Assessed Jul 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wg-easy/wg-easy/commit/66b292b11bde3664f05ffb016c8082665d261ded | [email protected] | Source CodeVendor |
| https://github.com/wg-easy/wg-easy/pull/2661 | [email protected] | Issue TrackingVendor |
| https://www.vulncheck.com/advisories/wireguard-easy-weak-token-generation-information-disclosure-via-otl-route | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | [email protected] |
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WireGuard Easy | <= 15.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 18, 2026 | CVE Modified | CISA-ADP |
| Jul 16, 2026 | New CVE Received | [email protected] |