Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in GaijinEntertainment DagorEngine (prog/3rdPartyLibs/miniupnpc modules).
The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption.
CVSS 3.1MEDIUM 4.8·Network·No auth·No interaction·EPSS 0.00135·Published 2026-10-20·Fixed in 2.59.0.9CWE-319
