Threats affecting pkg:github/wg-easy

CVE-2026-63089 affects wg-easy versions up to 15.3.0 and involves a cryptographically weak pseudo-random number generator used for one-time link token generation. This vulnerability allows unauthenticated attackers to brute-force tokens due to a limited keyspace of 1000 values and lack of rate limiting or token expiration validation. Exploitation enables recovery of WireGuard peer credentials, including PrivateKey and PresharedKey, allowing impersonation of peers on the VPN network. The issue was fixed in commit 66b292b.