CVE-2021-41093

CVE-2021-41093 is a critical vulnerability affecting Wire, an open-source secure messenger, where an attacker with an old but valid access token could take over an account by changing the associated email address. This flaw has been patched in Wire version 3.86, which implemented a new endpoint requiring an additional authentication cookie. With a CVSS score of 9.8 (CRITICAL), this vulnerability poses a significant risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.