CVE-2021-21396

wire-server is an open-source back end for Wire, a secure collaboration platform. In wire-server from version 2021-02-16 and before version 2021-03-02, the client metadata of all users was exposed in the `GET /users/list-clients` endpoint. The endpoint could be used by any logged in user who could request client details of any other user (no connection required) as far as they can find their User ID. The exposed metadata included id, class, type, location, time, and cookie. A user on a Wire backend could use this endpoint to find registration time and location for each device for a given list of users. As a workaround, remove `/list-clients` from nginx config. This has been fixed in version 2021-03-02.

• CWE-200

• https://github.com/wireapp/wire-server/commit/7ba2bf4140282557cf215e0b2c354d4d08cd3421Patch, Third Party Advisory
• https://github.com/wireapp/wire-server/releases/tag/v2021-03-02Third Party Advisory
• https://github.com/wireapp/wire-server/security/advisories/GHSA-qx8q-rhq2-rg4jPatch, Third Party Advisory
• https://github.com/wireapp/wire-server/commit/7ba2bf4140282557cf215e0b2c354d4d08cd3421Patch, Third Party Advisory
• https://github.com/wireapp/wire-server/releases/tag/v2021-03-02Third Party Advisory
• https://github.com/wireapp/wire-server/security/advisories/GHSA-qx8q-rhq2-rg4jPatch, Third Party Advisory

Published

Mar 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21390MinIO is an open-source high performance object storage serv…5.9
• CVE-2021-21391CKEditor 5 provides a WYSIWYG editing solution. This CVE aff…6.5
• CVE-2021-21392Synapse is a Matrix reference homeserver written in python (…6.3
• CVE-2021-21393Synapse is a Matrix reference homeserver written in python (…6.5
• CVE-2021-21394Synapse is a Matrix reference homeserver written in python (…6.5
• CVE-2021-21395Magneto LTS (Long Term Support) is a community developed alt…4.3
• CVE-2021-21398PrestaShop is a fully scalable open source e-commerce soluti…5.4
• CVE-2021-21399Ampache is a web based audio/video streaming application and…7.5
• CVE-2021-2140Vulnerability in the Oracle Financial Services Analytical Ap…6.1
• CVE-2021-21400wire-webapp is an open-source front end for Wire, a secure c…6.5
• CVE-2021-21401Nanopb is a small code-size Protocol Buffers implementation …7.1
• CVE-2021-21402Jellyfin is a Free Software Media System. In Jellyfin before…6.5