CVE-2026-92749 SafeLine through 9.4.1 Authentication Bypass via Weak Session Secret
Attackers can forge administrator session cookies by predicting weak session secrets, gaining unauthorized control of the SafeLine management console.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92749?
CVE-2026-92749 is a critical vulnerability in chaitin SafeLine, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator session cookies to gain control of protected sites.
Weakness: CWE-338
Which versions are affected by CVE-2026-92749?
How do I fix CVE-2026-92749?
No fix has been published for CVE-2026-92749 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-92749 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92749 exists.
Sources
Also known as GHSA-9q3x-j473-5399.