Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Remnawave Backend is the backend for the Remnawave proxy and user management solution. Prior to 2.7.5, a glitch in the HWID device registration logic allows an authenticated user to bypass the configured limit for HWID devices and register more devices than expected, allowing them to resell subscriptions and consume excessive traffic. This vulnerability is fixed in 2.7.5.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-39880 Authenticated HWID Device Registration Bypass in Remnawave Backend Below 2.7.5 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-39880
Post summary
The CVE details an authenticated bypass of hardware ID device registration in Remnawave backend versions below 2.7.5, with no PoC, exploit code, patch, or active exploitation information disclosed.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | remnawave | remnawave_backend | - | - | - |