Description

If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read license information belonging to another handle.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-27T10:16:40.313Z",
  "pubdate": "2026-08-27T10:16:40.313Z",
  "executiveSummary": "This vulnerability involves an improper authentication mechanism within the CodeMeter Runtime when operating in server mode. The core security defect resides in the reliance on a cryptographically weak Session Identifier (SID) as the exclusive authentication factor for managing session handles.\nBy failing to implement robust, cryptographically secure tokens or multi-factor validation, the application allows unauthorized entities to perform brute-force attacks against the SID space. Successful exploitation grants an attacker the ability to hijack or masquerade as legitimate session handles.\nThe vulnerability affects CodeMeter Runtime versions prior to 8.41a and 9.10. The impact of this flaw is significant, as it permits unauthorized access to sensitive license information managed by the server. An attacker requires network access to the CodeMeter server and the capability to conduct automated brute-force attempts. This vulnerability poses a high risk to organizational intellectual property and license management integrity, as it circumvents the expected access control layer between distinct client sessions.",
  "technicalDetails": "The vulnerability originates in the session management logic of the CodeMeter Runtime server component. When a client initiates a connection, the server assigns a session handle to facilitate interaction and track license usage. The security of this handle is dependent entirely on the SID provided during subsequent requests.\nThe root cause is a cryptographic weakness in the generation or entropy of the SID. Because the SID serves as the sole authenticator for the associated handle, the security model assumes that the SID is unpredictable and unguessable. However, due to insufficient randomness, the SID space is susceptible to exhaustive search or brute-force methodologies.\nThe attack flow proceeds as follows: First, the attacker establishes a network connection to the CodeMeter Runtime server. Second, the attacker initiates a series of automated, high-frequency requests directed at the server's session handling functions. During this phase, the attacker systematically iterates through potential SID values. Since the SID is the only mechanism the server uses to validate the legitimacy of a request for a specific handle, the server fails to distinguish between the legitimate session owner and the attacker.\nOnce the attacker successfully identifies a valid SID associated with an active handle, they can transmit requests that the server interprets as originating from the hijacked session. This allows the attacker to query the server for sensitive license information, effectively bypassing the intended access isolation between different users or client processes.\nThe vulnerable component is the handle validation logic within the CodeMeter Runtime server. This exposure is present in network-facing implementations of the software. Because the authentication process does not incorporate rate limiting, account lockout mechanisms, or strong cryptographic binding, the brute-force attack becomes a reliable vector for gaining unauthorized read access to license data. The post-exploitation impact includes the exposure of license configurations and potentially other session-specific metadata managed by the CodeMeter service, leading to a complete compromise of the session-level confidentiality and authorization integrity."
}