CVE Feed

    Dashboard / CVE / CVE-2026-78807

    CVE-2026-78807

    An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c

    Published:Sep 11, 2026
    Last Modified:Sep 13, 2026
    EPS:Sep 11, 2026
    EPSS Score:0.0008
    CVSS Score:7.1

    Affected Products

    Vendor
    W1.fi
    Product
    Wpa Supplicant

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-346 Origin Validation Error

    Related CVEs

    CVE-2024-5290 (CVSS 8.8) — An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which a…
    CVE-2023-52160 (CVSS 6.5) — The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attac…
    CVE-2022-23304 (CVSS 9.8) — The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-ch…
    CVE-2022-23303 (CVSS 9.8) — The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channe…
    CVE-2021-30004 (CVSS 5.3) — In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishan…
    CVE-2021-27803 (CVSS 7.5) — A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) …
    CVE-2019-16275 (CVSS 6.5) — hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain s…
    CVE-2019-11555 (CVSS 5.9) — The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does no…
    CVE-2019-9495 (CVSS 3.7) — The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a resul…
    CVE-2019-9497 (CVSS 8.1) — The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar an…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-78807 — W1.fi (High 7.1) | CVE-DB