CVE-2026-63089

Name of the Vulnerable Software and Affected Versions WireGuard Easy versions prior to 15.3.1

Description An issue exists where one-time link tokens are generated using a cryptographically weak method. The token is computed using CRC32 (a cyclic redundancy check used for error-detecting) over a random value limited to a range between 0 and 999. This allows unauthenticated network attackers to recover WireGuard peer credentials, including the PrivateKey and PresharedKey, by brute-forcing a maximum of 1000 candidate tokens per client ID. Attackers can enumerate these tokens via the unauthenticated '/cnf/:oneTimeLink' endpoint, which does not implement rate limiting or validate token expiration, enabling the impersonation of a peer on the VPN network.

Recommendations Update WireGuard Easy to the version containing commit 66b292b. Restrict access to the '/cnf/:oneTimeLink' endpoint to minimize the risk of exploitation.