Read the docs
TI-2026-28759 Aliases CVE-2026-39880

Remnawave Backend has a race condition in HWID device limit allows bypassing max devices

Priority MEDIUM 56CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Remnawave Backend is the backend for the Remnawave proxy and user management solution. Prior to 2.7.5, a glitch in the HWID device registration logic allows an authenticated user to bypass the configured limit for HWID devices and register more devices than expected, allowing them to resell subscriptions and consume excessive traffic. This vulnerability is fixed in 2.7.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0019 8th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed backend (remnawave): 2.7.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
remnawavebackendbefore 2.7.52.7.5Patch availableCNA
  • backend Vendorremnawave Affected before 2.7.5 Fixed in 2.7.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:remnawave:remnawave_backend:*:*:*:*:*:*:*:*up to 2.7.4Vulnerableremnawave
  • cpe:2.3:a:remnawave:remnawave_backend:*:*:*:*:*:*:*:* Versions up to 2.7.4 Vulnerable ·remnawave

Remediation

  • Fix · CNA backend (remnawave) Fixed in 2.7.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-39880

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences