CVE-2026-33591: Wapt Server Auth Bypass Vulnerability

CVE-2026-33591 Overview

CVE-2026-33591 is an authentication bypass vulnerability in WAPT Server versions prior to 2.6.1.17813. A remote unauthenticated attacker can send a specially crafted packet to bypass security restrictions and retrieve a valid session token for a targeted account. The flaw is classified under CWE-288: Authentication Bypass Using an Alternate Path or Channel. Successful exploitation grants an attacker authenticated access to WAPT Server, which manages software deployment across enterprise endpoints. This access can be leveraged to push arbitrary packages to managed clients, effectively enabling widespread code execution across the environment.

Critical Impact
Unauthenticated remote attackers can obtain valid session tokens for arbitrary WAPT Server accounts, enabling full compromise of managed endpoints.

Affected Products

WAPT Server versions prior to 2.6.1.17813
WAPT Server versions prior to 2.6.0.16856 (initial fix branch)
Enterprise deployments using WAPT for software distribution management

Discovery Timeline

2026-08-03 - CVE-2026-33591 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-33591

Vulnerability Analysis

WAPT Server is an open-source software deployment and package management system used to distribute software and updates to Windows endpoints across enterprise networks. The vulnerability resides in the server's authentication handling logic, which fails to properly validate incoming requests before issuing session tokens.

An attacker sends a specially crafted network packet to the WAPT Server. Because the server accepts an alternate authentication path without validating the requestor's identity, it returns a valid session token bound to a targeted account. The attacker then reuses that token to authenticate to the server as the targeted user.

The issue is scored under CVSS v4.0 with maximum impact on confidentiality, integrity, and availability of both the vulnerable component and downstream systems. WAPT Server's role as a package distribution platform means that a compromised session can propagate to every managed endpoint.

Root Cause

The root cause is an authentication bypass using an alternate path or channel [CWE-288]. The server exposes a code path that issues session tokens without enforcing credential verification. This allows the token issuance logic to be triggered by unauthenticated network input.

Attack Vector

The attack is remote, network-based, and requires no authentication or user interaction. An attacker with network reachability to the WAPT Server management interface can trigger the flaw with a single crafted packet. Exploitation yields a valid session token, which the attacker uses to interact with the server as the compromised account, including administrative accounts.

No verified proof-of-concept code is publicly available at the time of writing. See the WAPT Security Bulletin for vendor-side technical detail.

Detection Methods for CVE-2026-33591

Indicators of Compromise

Unexpected session tokens issued to accounts from unfamiliar source IP addresses in WAPT Server access logs
Administrative actions in WAPT (package uploads, host assignments, agent commands) performed outside change windows or by dormant accounts
New or modified WAPT packages deployed to endpoints without a corresponding change ticket
Authentication events for privileged WAPT accounts originating from external or non-management network segments

Detection Strategies

Monitor WAPT Server HTTP/HTTPS access logs for anomalous request patterns preceding successful authentication events
Correlate WAPT session creation events with expected administrator source IP ranges and alert on deviations
Baseline typical package deployment cadence and flag bursts of new package pushes or agent command executions
Inspect endpoint telemetry for WAPT-agent-initiated process executions that do not map to approved deployments

Monitoring Recommendations

Forward WAPT Server logs, web server logs, and database query logs to a centralized SIEM for correlation and retention
Enable network flow logging on the WAPT management interface and alert on connections from non-administrative subnets
Track WAPT agent activity on endpoints using EDR telemetry to identify software installations that bypass normal change control
Review authentication and session-issuance events daily until patching is confirmed across all servers

How to Mitigate CVE-2026-33591

Immediate Actions Required

Upgrade WAPT Server to version 2.6.1.17813 or later immediately
Restrict network access to the WAPT Server management interface to trusted administrative subnets only
Rotate all WAPT account credentials and invalidate existing session tokens after patching
Audit recent WAPT package deployments and agent command history for unauthorized activity

Patch Information

Tranquil IT released fixed versions of WAPT Server addressing this authentication bypass. Refer to the WAPT Change Log 2.6.1 and the WAPT Change Log 2.6.0 for release details. Upgrade to 2.6.1.17813 or later to fully remediate CVE-2026-33591.

Workarounds

Place the WAPT Server behind a VPN or bastion host so the management interface is not reachable from untrusted networks
Apply firewall rules that allow inbound connections only from designated administrator workstations and WAPT agents
Temporarily suspend the WAPT Server service in environments where immediate patching is not possible and unauthenticated network exposure exists
Enable multi-factor authentication on any upstream identity provider integrated with WAPT to limit reuse of stolen session context

bash

# Example firewall rule restricting WAPT Server management port to an admin subnet
# Replace 10.0.10.0/24 with your administrative network range
iptables -A INPUT -p tcp --dport 443 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP