EUVD-2026-82334Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Authenticated low-privilege user (PR:L) over the network (AV:N) trivially subscribes to the WebSocket (AC:L, no UI); only limited metadata leaks (C:L), with no integrity or availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
WireGuard Portal, or wg-portal, is a web-based configuration portal for WireGuard server management. From 2.2.0 until 2.3.0, the authenticated GET /api/v0/ws statistics WebSocket in internal/app/api/v0/handlers/endpoint_websocket.go subscribes to TopicPeerStatsUpdated and TopicInterfaceStatsUpdated and forwards every TrafficDelta event without per-user authorization in handleWebsocket(). A low-privilege user can enumerate peer public keys through EntityId and monitor BytesReceived and BytesTransmitted values for peers belonging to other users. The same connection exposes interface_stats and interface names that the REST API limits to administrators. Tunnel content, AllowedIPs, and user identities remain authorization-gated. This issue is fixed in version 2.3.0.
AnalysisAI
Broken per-user authorization in WireGuard Portal (wg-portal) versions 2.2.0 through 2.2.x allows an authenticated low-privilege user to enumerate other users' peer public keys and monitor their BytesReceived/BytesTransmitted counters by connecting to the statistics WebSocket at /api/v0/ws. The same endpoint also exposes administrator-only interface names and interface statistics, though tunnel content, AllowedIPs, and user identities remain authorization-gated; the issue is fixed in version 2.3.0. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated low-privilege account on a multi-user WireGuard Portal instance running 2.2.0 through 2.2.x, and the attacker must connect to the authenticated GET /api/v0/ws statistics WebSocket, which prior to 2.3.0 forwarded all TopicPeerStatsUpdated and TopicInterfaceStatsUpdated events without per-user filtering. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-severity broken-authorization (information-disclosure) issue, and the signals agree on that. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to WireGuard Portal 2.3.0, which is the vendor-released patch containing commit 316f389f11f3129f8603fcf3014fa7f19d7b3273 and the authorization checks missing in earlier 2.2.x releases; see the release notes at https://github.com/h44z/wg-portal/releases/tag/v2.3.0 and the advisory at https://github.com/h44z/wg-portal/security/advisories/GHSA-r45j-3jxf-wgfr. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Path traversal in the uniget CLI (Go module gitlab.com/uniget-org/cli) before version 0.27.6 lets a local user read and
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allow
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
Concurrent SAML or OpenID Connect login attempts against SUSE NeuVector can cause one user to be issued another user's f
Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. Rated high severity (CVS
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command executi
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today