What’s Vulnerable › Vulnerabilities

CVE-2021-41093: Account takeover when having only access to a user's short lived token

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-10-04 · updated 2026-06-17
• Weakness: CWE-285

Description

Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they can take over an account by changing the email. This issue has been resolved in version 3.86 which uses a new endpoint which additionally requires an authentication cookie. See wire-ios-sync-engine and wire-ios-transport references. This is the root advisory that pulls the changes together.

Affected products

• wireapp wire-ios: before 3.86 — fixed in 3.86

How to fix

Upgrade to a fixed version: wireapp wire-ios 3.86. Check the vendor advisory for mitigations.

References

• https://github.com/wireapp/wire-ios-sync-engine/security/advisories/GHSA-w727-5f74-49xj
• https://github.com/wireapp/wire-ios-transport/security/advisories/GHSA-p354-6r3m-g4xr
• https://github.com/wireapp/wire-ios/commit/b0e7bb3b13dd8212032cb46e32edf701694687c7
• https://github.com/wireapp/wire-ios/security/advisories/GHSA-6f4c-phfj-m255
• https://github.com/wireapp/wire-server/security/advisories/GHSA-9rm2-w6pq-333m
• https://github.com/wireapp/wire-ios-sync-engine/security/advisories/GHSA-w727-5f74-49xj
• https://github.com/wireapp/wire-ios-transport/security/advisories/GHSA-p354-6r3m-g4xr
• https://github.com/wireapp/wire-ios/commit/b0e7bb3b13dd8212032cb46e32edf701694687c7
• https://github.com/wireapp/wire-ios/security/advisories/GHSA-6f4c-phfj-m255
• https://github.com/wireapp/wire-server/security/advisories/GHSA-9rm2-w6pq-333m

Get alerted when CVE-2021-41093 or the next vulnerability affects your stack