CVE-2026-109140

The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same key, nonce pair is used again after each restart...