War Thunder EUVD-2026-105305

The attacker must hold a passive man-in-the-middle / on-path network position between the War Thunder client and server (e.g., shared or hostile Wi-Fi, a compromised router, or upstream transit) and must capture the specific first data packet sent immediately after the TCP handshake, which carries the auth_jwt bearer token protected only by LZ4 compression (no TLS/encryption) - decompression alone reveals the plaintext token. Limiting factors that reduce real-world risk: the stolen token grants only temporary authenticated impersonation and access to low-sensitivity data (email, displayed phone); it cannot change account security settings, passwords, or 2FA, and gives no financial access or full account takeover. Exploitation is per-victim and non-automatable, and only affects War Thunder versions 2.57.1.140 up to (but not including) 2.59.0.9.

This is a genuine but modest-severity issue, not a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, base 4.8 Medium) tells a consistent story: no authentication or user interaction is needed to passively capture the token, but AC:H reflects the real constraint - the attacker must occupy a privileged on-path/man-in-the-middle network position and capture a specific packet (the very first one after the TCP handshake), which is a condition largely outside the attacker's control. Impact is limited (C:L/I:L/A:N): only low-sensitivity data (email, displayed phone) and short-lived authenticated impersonation, with the description explicitly ruling out full account takeover, password/2FA changes, or financial access. The SSVC framework corroborates low urgency: Exploitation=none (no observed or confirmed exploitation), Automatable=no (each attack requires per-victim on-path positioning), Technical Impact=partial - pointing toward a 'Track'-level decision rather than 'Act'. No EPSS score and no CISA KEV listing are provided, and nothing indicates active exploitation. One cross-source note: a GitHub reference named after the CVE exists (thewhatdohe/CVE-2026-107692), which commonly indicates a proof-of-concept or technical writeup, but PoC availability is NOT explicitly flagged in the input and was not independently verified - treat it as a lead, not confirmation. Overall: a legitimate cleartext-transmission flaw (CWE-319) worth patching, but real-world risk is bounded by the MITM prerequisite, non-automatability, and limited impact.

An attacker sharing a network with the victim (e.g., public or compromised Wi-Fi, or a position on the routing path) passively sniffs traffic as the War Thunder client connects, capturing the first post-handshake packet. Because the auth_jwt bearer token is only LZ4-compressed and not encrypted, the attacker decompresses it to recover the plaintext JSON payload and replays the token to impersonate the victim against game services, viewing data such as email and displayed phone number. A GitHub reference tied to this CVE may provide proof-of-concept or technical detail, but PoC availability is not confirmed in the input; the AC:H rating reflects that success depends on achieving on-path positioning and capturing the specific initial packet.