CVE-2026-92749

HighCVSS 8.1/10Last modified Sep 23, 2026

Description

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator session cookies to gain control of protected sites.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-338

Affected software

No affected versions have been published.

Timeline

Published: Sep 16, 2026
Last modified: Sep 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-927506.5Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve CVE-2026-927518.1CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of CVE-2026-927528.3metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing re CVE-2026-927537.1PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that lack ownership filte CVE-2026-927544.3PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization deco CVE-2026-927565.5Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption se CVE-2026-927575.5Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable CVE-2026-927585.5If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in CVE-2026-927596.5SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the CVE-2026-927606.5Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscr CVE-2026-927618.8WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Att CVE-2026-927628.8Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side aut