The CVE number for this vulnerability is CVE-2026-109140.

== Summary
Krill login-session tokens reuse their encryption nonce across restarts,
so any user who can log in can forge an "admin" token

== Affected products
Krill up to and including 0.16.0.

== Description
The vulnerability is that Krill encrypts every login-session token with
a nonce built from a counter that is reset to 0 on every Krill restart,
so the same (key, nonce) pair is used again after each restart.

== Solution
Install Krill 0.16.1 or later.

== Acknowledgments
We would like to thank Anthropic and Ada Logics for finding the vulnerability.