CVE-2026-33591 describes a critical security vulnerability in Wapt Server prior to version 2.6.1.17813. The flaw allows remote attackers with no authentication to bypass security controls by crafting and sending a specific packet. Successful exploitation results in the attacker obtaining a valid session token for an account, which could be used to impersonate that user and gain unauthorized access to the system. The vulnerability is categorized under CWE-288 (Authentication Bypass Using an Alternate Path or Channel). There are no known exploits in the wild and no patch or official remediation details have been provided in the input data.

The vulnerability permits remote unauthenticated attackers to bypass security restrictions and retrieve valid session tokens, which can lead to unauthorized access to user accounts on the Wapt Server. This compromises the confidentiality and integrity of the affected system and its data. Given the critical severity rating, exploitation could have significant security consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the Wapt Server and monitor for suspicious activity related to session token usage. Avoid exposing the server to untrusted networks. Follow vendor communications closely for updates on patches or mitigations.