What’s Vulnerable › Vulnerabilities

CVE-2021-41094: Mandatory encryption at rest can be bypassed (UI) in Wire app

• Severity: medium (CVSS 4.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-10-04 · updated 2026-06-17
• Weakness: CWE-668

Description

Wire is an open source secure messenger. Users of Wire by Bund may bypass the mandatory encryption at rest feature by simply disabling their device passcode. Upon launching, the app will attempt to enable encryption at rest by generating encryption keys via the Secure Enclave, however it will fail silently if no device passcode is set. The user has no indication that encryption at rest is not active since the feature is hidden to them. This issue has been resolved in version 3.70

Affected products

• wireapp wire-ios: from 3.68 before 3.70 — fixed in 3.70

How to fix

Upgrade to a fixed version: wireapp wire-ios 3.70. Check the vendor advisory for mitigations.

References

• https://github.com/wireapp/wire-ios/commit/5ba3eb180efc3fc795d095f9c84ae7f109b84746
• https://github.com/wireapp/wire-ios/security/advisories/GHSA-h4m7-pr8h-j7rf
• https://github.com/wireapp/wire-ios/commit/5ba3eb180efc3fc795d095f9c84ae7f109b84746
• https://github.com/wireapp/wire-ios/security/advisories/GHSA-h4m7-pr8h-j7rf

Get alerted when CVE-2021-41094 or the next vulnerability affects your stack