---
id: "CVE-2026-107692"
kind: "vulnerability"
aliases: ["CVE-2026-107692"]
title: "War Thunder client sends auth token in LZ4-compressed plaintext"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["game-client", "other", "war-thunder"]
not_affected_if: ["encrypted-network-path", "no-game-client-use"]
published_at: "2026-10-20T20:17:14+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T04:33:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107692", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# War Thunder client sends auth token in LZ4-compressed plaintext

The War Thunder game client sends its auth_jwt bearer token in its first packet after the TCP handshake, compressed with LZ4 but not encrypted. A network observer can decompress that packet and reuse the token to impersonate the player for game services, including viewing email and phone details.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107692

## From the sources

The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker positioned on the network path can passively intercept and decompress this packet to reveal the plaintext JSON payload. This vulnerability allows for temporary authenticated impersonation, enabling an attacker to access game services and certain user data (such as email address and displayed phone number) as the affected user. While this allows for unauthorized access to gameplay, it does not facilitate full account takeover, as it cannot be used to modify account security settings, change passwords, bypass two-factor authentication for account management, or access financial information.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_