CVE-2026-92749 - Insecure Session Signing Secret Generation in SafeLine

SafeLine versions up to and including 9.4.1 contain a critical cryptographic vulnerability where the session-signing secret for the management console is derived using a time-seeded math/rand pseudo-random number generator. This implementation flaw allows an unauthenticated remote attacker to perform an offline reconstruction attack. By estimating the installation timestamp of the SafeLine instance, an attacker can brute-force or reverse the PRNG state to recover the secret key. Once the secret is compromised, attackers can forge valid administrative session cookies. This effectively bypasses authentication, granting the attacker full control over the management interface of the affected SafeLine deployment and enabling configuration changes, traffic manipulation, or access to sensitive security logs.

Impact

Successful exploitation allows for full administrative compromise of the SafeLine management console. Given the nature of SafeLine as a Web Application Firewall, this access grants an attacker the ability to disable security rules, intercept or modify traffic, and gain persistent control over the security posture of all protected backend applications. The vulnerability impacts any SafeLine installation deployed in a network-accessible environment where the attacker can ascertain or estimate the installation time.

Recommendation

Prioritized actions for security teams managing SafeLine deployments:

• Upgrade all SafeLine instances to version 9.4.2 or later immediately to patch CVE-2026-92749.
• Until the upgrade can be performed, restrict access to the SafeLine management interface to authorized administrative IP addresses via firewall/ACL rules.
• Review management console access logs for anomalies in session token usage or rapid successive login attempts from single or varied source IPs that might indicate brute-force activity.