Security Practice PRO

The Subscription-Page Vulnerability: How to Close It

Remnawave's separate browser component, the subscription page, got a critical vulnerability. The author closed the exploit details for three months under responsible disclosure — meaning the window is already open and a public attack method is on the way. Below is a ten-second check of whether you're vulnerable, and two working ways to close it.

Briefly on the situation. In the separate remnawave/subscription-page component — an optional pretty front for the subscription page — a critical hole was found. A fix is out, exploit details are under a three-month embargo. That means "how to break it" is known to only a few for now, but in a quarter the method will be published, and unpatched pages will start getting scooped en masse. Close it now.

Only the separate browser component subscription-page is vulnerable. The Remnawave backend itself (panel, API) is…

This guide is part of paid access

Get full access to unlock the text, configs and builder.

Unlock access →