Remnawave Backend is the backend for the Remnawave proxy and user management solution. Prior to 2.7.5, a glitch in the HWID device registration logic allows an authenticated user to bypass the configured limit for HWID devices and register more devices than expected, allowing them to resell subscriptions and consume excessive traffic. This vulnerability is fixed in 2.7.5.
References
| Link | Resource |
|---|---|
| https://github.com/remnawave/backend/security/advisories/GHSA-985p-44h5-v3pq | Exploit Vendor Advisory |
Configurations
History
17 Apr 2026, 20:38
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:remnawave:remnawave_backend:*:*:*:*:*:*:*:* | |
| References | () https://github.com/remnawave/backend/security/advisories/GHSA-985p-44h5-v3pq - Exploit, Vendor Advisory | |
| First Time |
Remnawave
Remnawave remnawave Backend |
08 Apr 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-08 20:16
Updated : 2026-04-17 20:38
NVD link : CVE-2026-39880
Mitre link : CVE-2026-39880
CVE.ORG link : CVE-2026-39880
JSON object : View
Products Affected
remnawave
- remnawave_backend
CWE
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')