CVE-2026-33591

CriticalCVSS 10.0/10Last modified Oct 23, 2026

Description

A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass security restriction using a specially crafted packet and retrieve a valid session token for the targeted account.

Metrics

CVSS 4.0 10.0/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-288

Affected software

Vendor	Product	Versions
Tranquil IT Systems	WAPT Server	>= 2.6.0.16767, <= 2.6.1.17787

References

Timeline

Published: Aug 3, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-335927.5An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of Fin CVE-2026-335937.5A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.CVE-2026-335947.5A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH backend, causing querie CVE-2026-335957.5A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 connection, as some reso CVE-2026-335966.5A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses by sending a flood of CVE-2026-335977.5PRSD detection denial of service CVE-2026-335989.1A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a CVE-2026-335998.1A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via either the autoUpgrade (CVE-2026-33607.5The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versio CVE-2026-336004.9An RPZ sent by a malicious authoritative server can result in a null pointer dereference, caused by a missing consistency check and leading CVE-2026-336014.9If you use the zoneToCache function with a malicious authoritative server, an attacker can send a zone that result in a null pointer derefer CVE-2026-336028.2A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, triggering an out-of-bou