Executive brief
SafeLine is a self-hosted web application firewall and reverse proxy used to protect websites from attacks. The management console derives its session-signing secret from a time-seeded random number generator, allowing attackers who know the installation timestamp to offline reconstruct the secret and forge administrator session cookies, gaining full control of the protected sites.
Technical details
The vulnerability is a cryptographic weakness in session secret generation (CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator). SafeLine's management console generates the session-signing secret using a time-seeded math/rand generator in the initOptions() function, which produces predictable output once the seed (installation time) is known. An unauthenticated remote attacker who can estimate the install timestamp can offline brute-force or regenerate the exact secret key used to sign administrator session cookies. With the secret, attackers can forge valid session cookies without authentication and gain administrative access to the WAF, allowing them to disable protections and compromise protected web applications. The vulnerability affects SafeLine through version 9.4.1. No patch information is currently available in the advisory.
Affected products
- Chaitin SafeLine through 9.4.1
Timeline
- 2026-09-16: disclosed
- 2026-09-16: advisory