Technical impact
The affected backend contains a race condition within the HWID device registration logic. An authenticated user can take advantage of this flaw to bypass the system‑configured maximum number of HWID devices, allowing registration of additional devices beyond the allowed quota. This exploitation enables the user to resell subscriptions and consume traffic in excess of what the subscription permits, leading to potential financial loss and service degradation for other customers.
Affected Systems
Remnawave Backend, all releases prior to version 2.7.5. The vulnerability is fixed in version 2.7.5. Any deployment using older releases with a configured HWID device limit is vulnerable.
Risk and Exploitability
The CVSS v3.1 score of 5.0 indicates medium severity. Because the flaw requires the attacker to be an authenticated user and there is no publicly disclosed exploit code, the immediate risk is moderated, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a race condition during concurrent device registration, which may be difficult to reliably trigger without repeated attempts. Nevertheless, the ability to bypass device limits can result in resource abuse and increased operational costs.
