Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2026-81576

Improper Authentication of Session Handles

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
wibu

Description

If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read license information belonging to another handle.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

wibu-systems-ag codemeter-runtime

Default version status: unaffected

  • 9.00 to < 9.10affected
  • 8.00 to < 8.41aaffected
  • 7.00affected
  • 6.00affected

References