CVE-2026-78807: wpa_supplicant Authentication Bypass Vulnerability

CVE-2026-78807 Overview

CVE-2026-78807 is a vulnerability in wpa_supplicant versions prior to v2.12. The flaw resides in the driver-based Pairwise Master Key Security Association (PMKSA) selection path in wpa.c. Missing validation allows a local attacker to bypass proper network context and Authentication and Key Management Protocol (AKMP) matching for PMKSA caching. The issue is classified as [CWE-346] Origin Validation Error.

Critical Impact
A local attacker with low privileges can bypass network context and AKMP matching enforcement in PMKSA caching, undermining the integrity guarantees of cached wireless security associations.

Affected Products

wpa_supplicant all versions before v2.12
Linux and Unix-like operating systems bundling vulnerable wpa_supplicant builds
Embedded and IoT devices using upstream wpa_supplicant for Wi-Fi association

Discovery Timeline

2026-09-11 - CVE-2026-78807 published to the National Vulnerability Database
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-78807

Vulnerability Analysis

The vulnerability affects how wpa_supplicant selects cached PMKSA entries when the underlying driver handles roaming decisions. In the driver-based selection path within wpa.c, the supplicant fails to fully validate that a cached PMKSA entry matches the intended network context and negotiated AKMP before reuse.

PMKSA caching accelerates re-association to a previously authenticated access point by reusing derived key material. The security model requires that a cached entry only be reused when the network identity and AKMP suite match the current association attempt. Missing validation breaks this binding.

A local attacker with the ability to influence supplicant state or configuration can cause the supplicant to reuse a PMKSA entry across contexts that should be isolated. This weakens the authentication guarantees expected from IEEE 802.11 key management. Refer to the W1.fi Security Analysis for upstream detail.

Root Cause

The root cause is an origin validation error [CWE-346]. The driver-based PMKSA selection code path in wpa.c omits checks that confirm the cached association's network context and AKMP match the current profile before the entry is selected for reuse.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker manipulates supplicant-visible state so that the driver-based selection routine returns a PMKSA entry that should not have been eligible, resulting in cross-context reuse of cached keying material.

No verified public exploit code is available. The vulnerability mechanism is described in prose based on the upstream advisory; see the W1.fi Security Analysis for technical detail.

Detection Methods for CVE-2026-78807

Indicators of Compromise

Unexpected successful re-association events using PMKSA caching for network profiles that were not recently authenticated.
Supplicant logs showing PMKID reuse across differing SSIDs or AKMP suites on the same client.
Driver-reported roaming events that do not correspond to a matching supplicant network block.

Detection Strategies

Inventory endpoints running wpa_supplicant and compare installed versions against v2.12 or later.
Enable verbose supplicant logging with -dd and audit PMKSA cache add, remove, and select events.
Correlate wireless association events with expected network profiles in centralized logging.

Monitoring Recommendations

Forward wpa_supplicant and kernel cfg80211/mac80211 logs into a centralized log platform for retention and query.
Alert on repeated PMKSA cache hits for distinct BSSIDs bound to different AKMP suites on a single client.
Track package versions of wpa_supplicant across managed Linux fleets to identify unpatched systems.

How to Mitigate CVE-2026-78807

Immediate Actions Required

Upgrade wpa_supplicant to version 2.12 or later on all affected endpoints and embedded devices.
Restrict local access to systems running vulnerable builds until patches are applied.
Audit deployed wireless profiles and remove stale or unused network blocks that could increase attack surface.

Patch Information

The issue is resolved in wpa_supplicant v2.12. Distribution maintainers ship backported fixes through their standard package channels. Consult the W1.fi Security Analysis for the upstream fix reference and apply vendor-supplied packages once available.

Workarounds

Disable PMKSA caching on affected clients where roaming performance is not required.
Prefer supplicant-managed selection over driver-based selection where the platform allows configuration.
Enforce strict per-network profile isolation and avoid sharing credentials across SSIDs with differing AKMP suites.

bash

# Verify installed wpa_supplicant version
wpa_supplicant -v

# Example: disable PMKSA caching for a network block in wpa_supplicant.conf
network={
    ssid="example"
    key_mgmt=WPA-PSK
    disable_pmksa_caching=1
}