{"id":"CVE-2026-107692","kind":"vulnerability","aliases":["CVE-2026-107692"],"related":[],"title":"War Thunder client sends auth token in LZ4-compressed plaintext","description":"The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker positioned on the network path can passively intercept and decompress this packet to reveal the plaintext JSON payload. This vulnerability allows for temporary authenticated impersonation, enabling an attacker to access game services and certain user data (such as email address and displayed phone number) as the affected user. While this allows for unauthorized access to gameplay, it does not facilitate full account takeover, as it cannot be used to modify account security settings, change passwords, bypass two-factor authentication for account management, or access financial information.","summary":"The War Thunder game client sends its auth_jwt bearer token in its first packet after the TCP handshake, compressed with LZ4 but not encrypted. A network observer can decompress that packet and reuse the token to impersonate the player for game services, including viewing email and phone details.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["game-client","other","war-thunder"],"not_affected_if":["encrypted-network-path","no-game-client-use"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T20:17:14+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:33:20+00:00","updated_at":"2026-10-25T04:33:20+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:33:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"War Thunder client sends auth token in LZ4-compressed plaintext","impact":"medium","summary":"The War Thunder game client sends its auth_jwt bearer token in its first packet after the TCP handshake, compressed with LZ4 but not encrypted. A network observer can decompress that packet and reuse the token to impersonate the player for game services, including viewing email and phone details.","category":"other","nicknames":[],"who_cares":["war-thunder","game-client"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker impersonates player for game services and reads contact details","analyst_note":"Check the NVD entry and the vendor's statement for a patched client version and whether the token can be revoked.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-game-client-use","encrypted-network-path"],"who_is_affected":"Players of War Thunder on networks where traffic can be observed by someone other than the game servers, such as shared or public Wi-Fi or a compromised local network. Team infrastructure is not involved, and anyone not running the War Thunder client can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00056,"input_tokens":3440,"output_tokens":432,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107692':14A,17A '-2026':13A,16A 'access':134C,158C,189C 'account':166C,175C,186C 'address':144C 'affect':151C 'allow':125C,155C 'attack':104C,132C 'auth':5A,32B,84C 'authent':81C,128C,184C 'bearer':34B,82C 'bypass':180C 'cannot':170C 'certain':138C 'chang':178C 'client':3A,20B,29B,78C 'compress':10A,44B,99C 'cve':12A,15A 'data':90C,140C 'decompress':54B,114C 'detail':73B 'display':146C 'email':70B,143C 'enabl':130C 'encrypt':49B,102C 'facilit':164C 'factor':183C 'financi':190C 'first':38B,89C 'full':165C 'game':19B,28B,66B,77C,135C 'game-cli':18B 'gameplay':160C 'handshak':43B,95C 'imperson':62B,129C 'includ':68B 'inform':191C 'intercept':112C 'json':121C 'jwt':33B,85C 'lz4':9A,46B,98C 'lz4-compressed':8A 'manag':187C 'modifi':174C 'network':51B,108C 'number':148C 'observ':52B 'packet':39B,56B,91C,116C 'passiv':111C 'password':179C 'path':109C 'payload':122C 'phone':72B,147C 'plaintext':11A,120C 'player':64B 'posit':105C 'rather':100C 'reus':58B 'reveal':118C 'secur':176C 'send':4A,30B 'servic':67B,136C 'set':177C 'takeov':167C 'tcp':42B,94C 'temporari':127C 'thunder':2A,24B,27B,76C 'token':6A,35B,60B,83C 'transmit':79C 'two':182C 'two-factor':181C 'unauthor':157C 'use':96C,172C 'user':139C,152C 'view':69B 'vulner':124C 'war':1A,23B,26B,75C 'war-thund':22B","nicknames":[],"mitigations":[],"who_affected":"Players of War Thunder on networks where traffic can be observed by someone other than the game servers, such as shared or public Wi-Fi or a compromised local network. Team infrastructure is not involved, and anyone not running the War Thunder client can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T20:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107692","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107692","severity":null,"published_at":"2026-10-20T20:17:14+00:00","modified_at":"2026-10-22T17:21:57+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}