CVE-2021-41093

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing the email. This issue has been resolved in version 3.86 which uses a new endpoint which additionally requires an authentication cookie. See wire-ios-sync-engine and wire-ios-transport references. This is the root advisory that pulls the changes together.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-285 CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Oct 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-410944.6Wire is an open source secure messenger. Users of Wire by Bund may bypass the mandatory encryption at rest feature by simply disabling their CVE-2021-410956.1Discourse is an open source discussion platform. There is a cross-site scripting (XSS) vulnerability in versions 2.7.7 and earlier of the `s CVE-2021-410967.5Rucky is a USB HID Rubber Ducky Launch Pad for Android. Versions 2.2 and earlier for release builds and versions 425 and earlier for nightly CVE-2021-410977.5aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in a CVE-2021-410987.5Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on CVE-2021-410997.5Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the underlying string library can be used to c CVE-2021-41107.5mruby is vulnerable to NULL Pointer Dereference CVE-2021-411009.8Wire-server is the backing server for the open source wire secure messaging application. In affected versions it is possible to trigger emai CVE-2021-411015.7wire-server is an open-source back end for Wire, a secure collaboration platform. Before version 2.106.0, the CORS ` Access-Control-Allow-Or CVE-2021-411037.8containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd whe CVE-2021-411047.5ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older CVE-2021-411057.5FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implement