CVE-2026-39880 json
Remnawave Backend has a race condition in HWID device limit allows bypassing max devices
published 2026-04-08 7 mo ago modified 2026-07-24 3 mo ago also EUVD-2026-20620
- cvss
- 5.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 8%
- public exploits
- 0
- none known
Summary
Remnawave Backend is the backend for the Remnawave proxy and user management solution. Prior to 2.7.5, a glitch in the HWID device registration logic allows an authenticated user to bypass the configured limit for HWID devices and register more devices than expected, allowing them to resell subscriptions and consume excessive traffic. This vulnerability is fixed in 2.7.5.
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/remnawave/backend/security/advisories/GHSA-985p-44h5-v3pq referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N |
| NVD | 3.1 | 4.9 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L |
Affected products
- remnawave backend
Classification
- Weakness
-
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
References
-
github.com
/remnawave/backend/security/advisories/GHSA-985p-44h5-v3pq
exploit, vendor-advisory
Sources
- CVE List CVE-2026-39880
- NVD CVE-2026-39880
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.