{"affected":[{"defaultStatus":"affected","product":"Krill","source":"CNA: NLnet Labs","vendor":"NLnet Labs","versions":[{"lessThan":"*","status":"unaffected","version":"0.16.1","versionType":"semver"}]}],"cveId":"CVE-2026-109140","cwes":["CWE-323"],"description":"The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same (key, nonce) pair is used again after each restart.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.4,"severity":"high","source":"CNA: NLnet Labs","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},{"score":8.4,"severity":"high","source":"NVD: sep@nlnetlabs.nl","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"}],"modifiedAt":1793639854737,"publishedAt":1793634118436,"references":[{"source":"CNA: NLnet Labs","tags":["vendor-advisory"],"url":"https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109140.txt"},{"source":"sep@nlnetlabs.nl","tags":[],"url":"https://www.nlnetlabs.nl/downloads/krill/CVE-2026-109140.txt"}],"remediation":[{"kind":"fix","source":"CNA: NLnet Labs","text":"This issue is fixed in 0.16.1 and all later versions."}],"revision":"d5843afbcdd2908ce12e2caf8167e5c4268a22cbe349d968316b745ede1446af","sources":[{"modifiedAt":1793635978713,"name":"CNA: NLnet Labs","retrievedAt":1793639320566,"url":"https://www.cve.org/CVERecord?id=CVE-2026-109140"},{"modifiedAt":1793639854737,"name":"NVD","retrievedAt":1793643557389,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109140"}],"ssvc":{"assessedAt":1793635967575,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Krill login-session tokens reuse their encryption nonce across restarts, so any user who can log in can forge an \"admin\" token","updatedAt":1793643557389}