Authentication bypass in WAPT Enterprise Server (CVE-2026-33591)

A vulnerability in WAPT Server allows a remote unauthenticated attacker to bypass security restrictions using a specially crafted packet and retrieve a valid session token for the targeted account. This could allow an attacker to impersonate any targeted account without valid credentials. Affected versions: - WAPT Enterprise / Discovery from 2.6.0.16767 up to 2.6.1.17787 We recommend updating to: 2.6.1.17813. CVSS 10.0 · our assessment: act_now Reference: https://www.wapt.fr/en/doc/wapt-security-bulletin.html Details: https://vuln.today/cve/CVE-2026-33591