Live › vulnerability › CVE-2026-107692
Go to dashboardThe War Thunder game client sends its auth_jwt bearer token in its first packet after the TCP handshake, compressed with LZ4 but not encrypted. A network observer can decompress that packet and reuse the token to impersonate the player for game services, including viewing email and phone details.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Players of War Thunder on networks where traffic can be observed by someone other than the game servers, such as shared or public Wi-Fi or a compromised local network. Team infrastructure is not involved, and anyone not running the War Thunder client can skip it.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker positioned on the network path can passively intercept and decompress this packet to reveal the plaintext JSON payload. This vulnerability allows for temporary authenticated impersonation, enabling an attacker to access game services and certain user data (such as email address and displayed phone number) as the affected user. While this allows for unauthorized access to gameplay, it does not facilitate full account takeover, as it cannot be used to modify account security settings, change passwords, bypass two-factor authentication for account management, or access financial information.
This page as .md · .json · in your agent: get_signal("CVE-2026-107692")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.