CVE-2026-92749: SafeLine Auth Bypass Vulnerability

CVE-2026-92749 Overview

CVE-2026-92749 is an authentication bypass vulnerability in SafeLine web application firewall through version 9.4.1. The management console derives its session-signing secret from a time-seeded math/rand pseudo-random number generator. This weak randomness source (CWE-338) lets attackers reconstruct the signing key offline. Unauthenticated remote attackers who can approximate the installation timestamp can regenerate the secret, forge valid administrator session cookies, and take control of protected sites.

Critical Impact
Attackers can forge administrator session cookies and gain full control of the SafeLine management console and any sites it protects, without credentials.

Affected Products

SafeLine WAF through version 9.4.1
SafeLine management console (management/webserver)
Deployments exposing the SafeLine console to the network

Discovery Timeline

2026-09-16 - CVE-2026-92749 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-92749

Vulnerability Analysis

The vulnerability resides in the SafeLine management webserver, which signs administrator session cookies using a secret generated at install time. That secret is produced by the Go standard library math/rand package, seeded with the current time. math/rand is a deterministic pseudo-random number generator and is not suitable for cryptographic use.

Because the seed is a bounded timestamp, the keyspace collapses to the number of seconds between plausible install dates. An attacker who can bound the install window can brute-force each candidate seed, regenerate the same output stream, and reproduce the exact signing secret. With the secret in hand, the attacker signs arbitrary session tokens that the console treats as authentic administrator sessions.

Root Cause

The root cause is insecure random number generation classified as CWE-338. The secret generator in management/webserver/utils/random.go uses math/rand instead of crypto/rand. The generated value is then persisted as the session-signing option referenced in management/webserver/model/option.go. Any component that seeds a PRNG with time and uses the output as key material inherits the same predictability.

Attack Vector

Exploitation is network-based and requires no authentication or user interaction. The attacker estimates the install timestamp of the target instance, iterates candidate seeds through the same math/rand sequence used by SafeLine, and derives candidate secrets. For each candidate secret, the attacker mints a session cookie for a known administrator identity and submits it to the console. A single successful request returns authenticated access. See the VulnCheck advisory and GitHub issue #1298 for additional technical context.

Detection Methods for CVE-2026-92749

Indicators of Compromise

Administrator session cookies presented from source IPs that never authenticated interactively against the console.
New or modified WAF site configurations, upstream rewrites, or rule exclusions that were not initiated by known operators.
Creation of additional administrator accounts or API tokens immediately after an unauthenticated request burst to /api/.
Access log entries showing single-request successful admin access without a preceding login POST.

Detection Strategies

Correlate session cookie usage against successful login events; alert when a valid session appears with no matching authentication.
Baseline administrative actions per identity and flag configuration changes originating from unfamiliar IPs or user agents.
Inspect audit logs for session tokens whose issuance time predates any recorded login for that account.

Monitoring Recommendations

Forward SafeLine management console access and audit logs to a centralized analytics platform for correlation.
Monitor egress from the SafeLine host for unexpected outbound connections that could indicate post-compromise activity.
Track version inventory for SafeLine deployments and alert on any instance still running 9.4.1 or earlier.

How to Mitigate CVE-2026-92749

Immediate Actions Required

Restrict network access to the SafeLine management console to trusted management networks or VPN only.
Rotate the session-signing secret and force logout of all administrator sessions after upgrading.
Rotate any administrator credentials and API tokens that could have been exposed through a forged session.
Review WAF configuration, rules, and upstream definitions for unauthorized modifications.

Patch Information

At the time of publication, refer to the SafeLine GitHub repository and issue #1298 for fixed release information. The fix must replace the math/rand based secret generator with crypto/rand and regenerate the persisted session-signing secret on upgrade. Verify after upgrade that the deployed version is later than 9.4.1.

Workarounds

Place the SafeLine management interface behind a reverse proxy or bastion that enforces mutual TLS or IP allow-listing.
Manually replace the persisted session secret with a value generated from a cryptographically secure source, then restart the console.
Disable exposure of the management port to the public internet until the patched version is deployed.

bash

# Example: restrict SafeLine management console to a management subnet with iptables
iptables -A INPUT -p tcp --dport 9443 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 9443 -j DROP