CVE-2026-81576: CWE-639 Authorization bypass through User-Controlled key in wibu-systems-ag codemeter-runtime

CodeMeter Runtime before versions 8.41a and 9.10, when configured as a server, issues handles per connection and relies solely on a cryptographically weak session identifier (SID) for authentication. This weakness allows an attacker to brute-force the SID, obtain another session's handle number, and access license information associated with that handle, effectively bypassing authorization controls. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key).

An attacker with low privileges can exploit this vulnerability to read license information belonging to other sessions by brute-forcing the weak SID. This results in unauthorized disclosure of sensitive license data. The CVSS v3.1 score is 7.7 (High), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality impact with no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published at this time. Users should monitor vendor communications for updates and consider restricting access to the CodeMeter Runtime server to trusted networks to reduce exposure until a fix is available.