CVE-2026-92749: SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-16 · updated 2026-09-23
Weakness: CWE-338

Description

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator session cookies to gain control of protected sites.

Affected products

chaitin SafeLine: through 9.4.1

References

https://github.com/chaitin/SafeLine
https://github.com/chaitin/SafeLine/blob/v9.4.1/management/webserver/model/option.go#L27
https://github.com/chaitin/SafeLine/blob/v9.4.1/management/webserver/utils/random.go#L10-L17
https://github.com/chaitin/SafeLine/issues/1298
https://www.vulncheck.com/advisories/safeline-through-9.4.1-authentication-bypass-via-weak-session-secret
https://github.com/chaitin/SafeLine/issues/1298

Get alerted when CVE-2026-92749 or the next vulnerability affects your stack