CVE-2026-107692

Received Received - Intake

War Thunder Client Auth Token Exposure via LZ4 Compression

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: CERT/CC

Description

The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker positioned on the network path can passively intercept and decompress this packet to reveal the plaintext JSON payload. This vulnerability allows for temporary authenticated impersonation, enabling an attacker to access game services and certain user data (such as email address and displayed phone number) as the affected user. While this allows for unauthorized access to gameplay, it does not facilitate full account takeover, as it cannot be used to modify account security settings, change passwords, bypass two-factor authentication for account management, or access financial information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-107692

EUVD

EUVD-2026-105305

Affected Vendors & Products

Vendor	Product	Version / Range
Gaijin	Entertainment	War Thunder 2.57.1.140

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-319	The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

Executive Summary

This vulnerability involves the War Thunder game client sending its authentication token (auth_jwt) in plaintext during the initial network handshake after the TCP connection is established. The token is only compressed using LZ4, not encrypted, allowing attackers with network access to intercept and decode it. This enables temporary impersonation of the user in game services and access to certain user data.

Detection Guidance

To detect this vulnerability, monitor network traffic for unencrypted JWT tokens transmitted in the first packet after TCP handshake. Use packet capture tools like Wireshark or tcpdump to inspect packets for LZ4-compressed JSON payloads containing auth_jwt tokens. Look for repeated or unusual authentication attempts.

Impact Analysis

An attacker could gain temporary access to your War Thunder account, allowing them to view your game data like email, phone number, clan info, stats, and vehicle progress. They could also create authenticated game sessions with room-level write access, but cannot change account settings, passwords, or bypass 2FA for account management.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, potentially violating privacy regulations like GDPR or HIPAA if personal or sensitive information is exposed. The lack of encryption during transmission may result in non-compliance with data protection requirements.

Mitigation Strategies

Update War Thunder to version 2.59.0.9 or later to patch the vulnerability. Avoid using public Wi-Fi or untrusted networks for gaming. Rotate your War Thunder account password and enable two-factor authentication if available. Monitor account activity for unauthorized access.

Hi! I’m here to help you understand CVE-2026-107692. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70