EUVD-2026-66983
GHSA-gj9j-5pfx-gc7p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network vector and PR:L reflect the required low-privilege server connection; S:C captures cross-session handle disclosure outside the attacker's authorization scope; I:N and A:N because only read-only license metadata is exposed.
Primary rating from Vendor (wibu).
CVSS VectorVendor: wibu
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read license information belonging to another handle.
AnalysisAI
Session handle confidentiality in Wibu-Systems CodeMeter Runtime is undermined when the software operates in server mode: versions before 8.41a and 9.10 assign cryptographically weak Session IDs (SIDs) as the sole per-connection authenticator, enabling an attacker with a low-privilege connection to brute-force SID values belonging to concurrent sessions. Successfully guessing a valid SID allows the attacker to recover another client's handle number and read the license information associated with that handle, constituting unauthorized cross-tenant license data disclosure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires CodeMeter Runtime to be explicitly configured in server mode - this is not the default client-only deployment and represents a deliberate administrative decision. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N reflects a network-reachable, low-complexity attack requiring only a low-privilege connection, consistent with the brute-force SID approach described. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has established a legitimate low-privilege connection to a network-exposed CodeMeter server systematically cycles through SID values, exploiting the weak entropy of the SID generation algorithm. The server, which uses the SID as its sole connection authenticator, accepts a correctly guessed SID belonging to a concurrent victim session and returns the associated handle number. … |
| Remediation | Upgrade CodeMeter Runtime to version 8.41a or later (8.x branch) or version 9.10 or later (9.x branch), per the Wibu-Systems security advisory at https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103401.pdf. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all CodeMeter Runtime server-mode deployments and restrict network access to authorized client IP ranges using firewalls or network segmentation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Codemeter Runtime
View allA heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthentic
CodeMeter Runtime before versions 8.41a and 9.10, when configured as a server, exposes its configuration command handler
Format string injection in CodeMeter Runtime before versions 8.41a and 9.10 enables reliable denial-of-service crashes a
Local privilege escalation in Wibu-Systems CodeMeter Runtime allows a low-privileged local attacker to delete arbitrary
CodeMeter Runtime in server mode crashes when processing crafted network requests using opcode 0x5e with a malformed dat
Wibu-Systems CodeMeter Runtime before 5.20 uses weak permissions (read and write access for all users) for codemeter.exe
In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file withou
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today