Vulnerability Description
SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator session cookies to gain control of protected sites.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/chaitin/SafeLine
- https://github.com/chaitin/SafeLine/blob/v9.4.1/management/webserver/model/optio
- https://github.com/chaitin/SafeLine/blob/v9.4.1/management/webserver/utils/rando
- https://github.com/chaitin/SafeLine/issues/1298
- https://www.vulncheck.com/advisories/safeline-through-9.4.1-authentication-bypas
- https://github.com/chaitin/SafeLine/issues/1298
FAQ
What is CVE-2026-92749?
CVE-2026-92749 is a vulnerability with a CVSS score of 8.1 (HIGH). SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers...
How severe is CVE-2026-92749?
CVE-2026-92749 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92749?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.