Authentication Bypass in SafeLine Management Console by Chaitin
CVE-2026-92749

9.2CRITICAL

Key Information:

Vendor

Chaitin

Status
Safeline
Vendor
CVE Published:
16 September 2026

What is CVE-2026-92749?

SafeLine, up to version 9.4.1, utilizes a weak method for generating the session-signing secret, relying on a time-seeded math/rand generator. This flaw permits unauthenticated remote attackers, who can derive the installation timestamp, to regenerate the secret key offline. With the reconstructed key, these attackers can forge valid administrator session cookies, enabling unauthorized access and control over secured sites. This vulnerability underscores the critical need for robust cryptographic practices in the generation of session secrets.

Affected Version(s)

SafeLine 0 <= 9.4.1

References

https://github.com/chaitin/SafeLine/issues/1298
issue-tracking
https://github.com/chaitin/SafeLine
product
https://github.com/chaitin/SafeLine/blob/v9.4.1/managemen...
technical-description

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.