CVE-2026-39880

Published: Apr 8, 2026Modified: Jul 24, 2026

4.9

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L

Exploitability: 1.8 / Impact: 2.7

Source: NVD

Description

Remnawave Backend is the backend for the Remnawave proxy and user management solution. Prior to 2.7.5, a glitch in the HWID device registration logic allows an authenticated user to bypass the configured limit for HWID devices and register more devices than expected, allowing them to resell subscriptions and consume excessive traffic. This vulnerability is fixed in 2.7.5.

Affected (1)

Products: Remnawave: Remnawave Backend

1 product

Remnawave Backend

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Remnawave Remnawave Backend	Up to 2.7.4

Related CWEs

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (1)

https://github.com/remnawave/backend/security/advisories/GHSA-985p-44h5-v3pq

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.