CVE-2026-33591CWE-288

CVE-2026-33591

published August 3, 2026

CVSS

10.0

EPSS

Percentile

53.2

In the wild

Unconfirmed

What it is

A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass

security restriction using a specially crafted packet and retrieve a valid

session token for the targeted account.

The record

Technical detail

CVSS: 10.0 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00714 · 53.2th percentile
Weakness: CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published: 2026-08-03T14:16Z

References (3)

EPSS history

Timeline