External risk intelligence

Wapt Server Session Token Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-33591

WAPT Server is a management and deployment solution often exposed to the network to facilitate endpoint communication and remote management, making its services and administrative interfaces commonly reachable in deployment environments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Wapt Server, allowing unauthenticated remote attackers to bypass security measures and obtain session tokens for user accounts. This issue impacts the server's ability to maintain secure user access and could potentially lead to unauthorized control if exploited. The primary concern is to confirm whether our environment is affected and to what extent.

Attackers can steal user session tokens remotely.
Protects administrative access and user account security.
Confirm relevance and exposure of Wapt Server instances.

Attack Path

How an attacker could exploit the issue

An attacker could remotely send a specially crafted network packet to the Wapt Server. This packet exploits a flaw in the server's security restrictions, allowing the attacker to obtain a valid session token for a targeted account without needing any prior authentication.

Remote, unauthenticated network access required.
Specially crafted packet triggers vulnerability.
Risk of unauthorized account access.

Live Threat

Current exploitation, exposure, and threat context

A remote, unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to the Wapt Server, which may allow them to bypass security restrictions and obtain a valid session token for an account. This could lead to unauthorized access to the Wapt Server and its managed systems.

Server session tokens could be exposed.
Specially crafted packets may bypass security.
Unauthorized access to server and systems.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Wapt Server's security restrictions can be bypassed by unauthenticated remote attackers, potentially leading to session token compromise. This advisory impacts teams responsible for managing and securing the Wapt Server infrastructure, including platform or infrastructure teams who maintain the Wapt Server environment, and potentially application owners if Wapt Server is integrated with specific applications. The immediate first step is to identify all Wapt Server instances, assess their network exposure and business criticality, and confirm the responsible ownership for remediation planning.

Wapt Server platform or infrastructure owners.
Verify Wapt Server network reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Wapt Server?

Wapt Server is a software solution used by IT teams for endpoint management, software deployment, and lifecycle administration. It functions as a central hub that communicates with managed machines across a network to automate tasks like patching and configuration.

What does CWE-288 mean for CVE-2026-33591?

CWE-288, or Authentication Bypass Using an Alternate Path or Channel, describes a weakness where software inadvertently allows access without proper identity verification. In the case of CVE-2026-33591, this means an attacker can circumvent standard security checks to obtain a valid session token, effectively tricking the server into treating them as an authenticated user.

How does an attacker trigger this vulnerability?

The vulnerability is triggered by sending a specially crafted network packet directly to the Wapt Server. Because this flaw exists in the handling of incoming communication, it does not require the attacker to have pre-existing credentials or a legitimate user account. Legitimate traffic that does not contain the specific malicious payload used to bypass these restrictions will not trigger the bug.

Is my Wapt Server instance at risk?

Your risk level depends on how your server is positioned. According to Halo Surface Signal, Wapt Server is often deployed in ways that make its administrative interfaces reachable across the network to facilitate remote management. If your instance is accessible from the internet or exposed to untrusted network segments, it is a higher priority for review than a server restricted to a tightly controlled, internal-only management network.

When should I update Wapt Server?

You should prioritize upgrading to version 2.6.1.17813 or later immediately. The first step is to inventory all instances of Wapt Server within your environment, confirm their network accessibility, and verify that they are running an affected version. Once identified, coordinate with your infrastructure team to apply the available update to close the authentication bypass gap.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.