CVE-2021-41100

CVE-2021-41100 affects Wire-server, the backend for the Wire secure messaging application. This critical vulnerability allows an attacker to change a user's email address using only a short-lived session token, leading to privilege escalation and potential account takeover. With a CVSS score of 9.8, the attack is network-based, low complexity, and requires no user interaction, resulting in high impact to confidentiality, integrity, and availability. While short-lived tokens are typically less secure than long-lived tokens, their exposure risk is higher due to frequent use and transmission in HTTP headers. There is currently no evidence of active exploitation, public exploit code, or significant community discussion regarding this vulnerability.