Session Token Encryption Issue in Krill by NLnet Labs
CVE-2026-109140

8.4HIGH

Key Information:

Vendor

Nlnet Labs

Status
Krill
Vendor
CVE Published:
2 November 2026

What is CVE-2026-109140?

The vulnerability in Krill arises from its approach to encrypting user login-session tokens. Each session token is encrypted using a nonce derived from a counter that resets to zero upon each restart of the Krill service. As a result, the identical (key, nonce) pair is reused following every restart, potentially allowing unauthorized access as session tokens may be predictable. Implementing robust nonce management strategies can mitigate this risk for users.

Affected Version(s)

Krill 0.16.1

References

https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109140.txt
vendor-advisory

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anthropic and Ada Logics, Aymen Benlamari
.