Skip to content
OpenAdvisories
Critical · 10.0 CVE-2026-33591 EUVD-2026-52256GHSA-jj6f-hxj9-r997

Authentication bypass on WaptServer

Published Aug 3, 2026 · Updated Aug 3, 2026 · Assigned by ENISA

Description

A vulnerability in Wapt Server before version 2.6.1.17813 allows a  remote unauthenticated attacker to bypass
security restriction using a specially crafted packet and retrieve a valid
session token for the targeted account.

Affected products

VendorProductAffectedFixed
Tranquil IT Systems WAPT Server 2.6.0.16767 – ≤ 2.6.1.17787 —

References