Executive brief
Remnawave Backend is the management component for a proxy and user subscription service. A flaw in how the system registers hardware IDs (HWID) allows users to bypass device limits, enabling them to connect more devices than their subscription allows. This can lead to unauthorized reselling of accounts and excessive bandwidth consumption, impacting the service provider's revenue and infrastructure costs.
Technical details
A race condition (CWE-362) exists in the HWID device registration logic of Remnawave Backend prior to version 2.7.5. The vulnerability is rooted in a 'check-then-act' pattern where the system counts existing devices and compares them against a limit without transactional locking or atomic operations. An authenticated attacker can exploit this by sending multiple simultaneous registration requests with different HWIDs. This allows the attacker to exceed the `hwidDeviceLimit` or `fallbackDeviceLimit`, facilitating unauthorized subscription sharing. The issue is resolved in version 2.7.5 by implementing proper synchronization or transactional logic.
Affected products
- Remnawave Backend < 2.7.5
Timeline
- 2026-04-07: advisory: GitHub Security Advisory published
- 2026-04-08: disclosed: CVE-2026-39880 published
- 2026-04-08: patched: Fixed in version 2.7.5