Vulnerability in War Thunder Game Client Authentication Mechanism

CVE-2026-107692

What is CVE-2026-107692?

The War Thunder game client is vulnerable due to the transmission of its authentication bearer token (auth_jwt) in plaintext format following the TCP handshake. It uses LZ4 compression rather than encryption, allowing attackers on the same network path to intercept and decompress the initial packet. This can lead to temporary impersonation of a user, granting access to game services and visible user data, such as email addresses and phone numbers. While this vulnerability permits unauthorized access to gameplay functionalities, it does not enable full account takeover or manipulation of sensitive account settings.

References