CVE-2026-107692
4.8 MEDIUMpublic exploit availablePublished 2026-10-20 · Updated 2026-10-22
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker positioned on the network path can passively intercept and decompress this packet to reveal the plaintext JSON payload. This vulnerability allows for temporary authenticated impersonation, enabling an attacker to access game services and certain user data (such as email address and displayed phone number) as the affected user. While this allows for unauthorized access to gameplay, it does not facilitate full account takeover, as it cannot be used to modify account security settings, change passwords, bypass two-factor authentication for account management, or access financial information.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-319
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2025-36421
- MEDIUMCVE-2026-100635PoC
- LOWCVE-2026-101057PoC
- MEDIUMCVE-2026-102670
- HIGHCVE-2026-103098
- HIGHCVE-2026-104704
- LOWCVE-2026-105245PoC
- LOWCVE-2026-105766PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.