Gaijin Entertainment War Thunder prior 2.59.0.9 Authentication Token Transmission auth_jwt cleartext transmission

Summaryinfo

A vulnerability has been found in Gaijin Entertainment War Thunder and classified as problematic. This affects an unknown part of the component Authentication Token Transmission. Performing a manipulation of the argument auth_jwt results in cleartext transmission. This vulnerability is known as CVE-2026-107692. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Gaijin Entertainment War Thunder. This affects an unknown part of the component Authentication Token Transmission. The manipulation of the argument auth_jwt with an unknown input leads to a cleartext transmission vulnerability. CWE is classifying the issue as CWE-319. The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. This is going to have an impact on confidentiality. The summary by CVE is:

The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker positioned on the network path can passively intercept and decompress this packet to reveal the plaintext JSON payload. This vulnerability allows for temporary authenticated impersonation, enabling an attacker to access game services and certain user data (such as email address and displayed phone number) as the affected user. While this allows for unauthorized access to gameplay, it does not facilitate full account takeover, as it cannot be used to modify account security settings, change passwords, bypass two-factor authentication for account management, or access financial information.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-107692 since 10/08/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1040 for this issue.

Upgrading to version 2.59.0.9 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Gaijin Entertainment

Name

• War Thunder

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion