What is CVE-2026-63089?

CVE-2026-63089 is a critical-severity vulnerability in Wg-easy, classified under Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). CVSS score: 9.3/10. Published 2026-07-16.

How severe is CVE-2026-63089?

Critical severity. CVSS v3 base score is 9.3 out of 10.

Vulnerability in Wg-easy

CVE-2026-63089

WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a k…

CVSS v3 metric

CVSS v3 base score 9.3 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N.

Affected products

Wg-easy — versions 0, 66b292b11bde3664f05ffb016c8082665d261ded

Weakness classification (CWE)

CWE-338 — Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CWE-613 — Insufficient Session Expiration

References

disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-63089?: CVE-2026-63089 is a critical-severity vulnerability in Wg-easy, classified under Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). CVSS score: 9.3/10. Published 2026-07-16.
How severe is CVE-2026-63089?: Critical severity. CVSS v3 base score is 9.3 out of 10.