Key Points
- AirSnitch is a set of attacks published at NDSS 2026 that bypass Wi-Fi client isolation on every tested router, including WPA3-Enterprise and Passpoint deployments.
- The attacks do not break WPA2/WPA3 encryption — they exploit how isolation is implemented across the Wi-Fi and Layer 2 network architecture.
- Authentication methods like EAP-TLS do not prevent the attacks themselves, but they reduce what an attacker can gain after achieving a man-in-the-middle position.
- Network architecture decisions — SSID separation, VLAN design, and where traffic is routed — determine the real impact.
What Is AirSnitch?
AirSnitch is a set of three attacks that systematically bypass Wi-Fi client isolation. It was first discovered and published by researchers at the University of California, Riverside and KU Leuven, and presented at the 2026 Network and Distributed Systems Security (NDSS) Symposium.
The vulnerability stems from the way client isolation is implemented across various vendors. Client isolation is intended to prevent devices on the same Wi-Fi network from communicating directly with each other. However, it is not defined in the IEEE 802.11 standard. As different vendors have implemented isolation differently, there are inconsistencies in how it operates across the network stack.
AirSnitch exploits those inconsistencies. The attacks allow a legitimate client on a network to position itself between other users and intercept or manipulate traffic.
Importantly, the attacks do not break Wi-Fi encryption. Instead, they exploit behavior across the wireless, switching, and routing layers.
AirSnitch has no CVE identifier because the issue is architectural and does not stem from a single software vulnerability.
How AirSnitch Works
The 2026 paper presenting the AirSnitch attack demonstrates three techniques, each at a different OSI layer. An attacker only needs one to succeed.
GTK Abuse (Encryption Layer)
On WPA2 and WPA3 networks, all clients share a Group Temporal Key (GTK) used to encrypt broadcast traffic.
Because every authenticated client receives the same key, an attacker can craft broadcast frames encrypted with the GTK that are accepted by other clients as valid network traffic.
How this attack works in practice:
- An attacker wraps a unicast IP packet inside a broadcast frame
- They encrypt the frame with the GTK
- They spoof the access point (AP)’s MAC address
- Finally, an attacker transmits the packet over the air
The victim device accepts the packet directly because it appears to come from the access point. Since the packet never passes through the AP’s forwarding logic, client isolation rules never apply.
This technique works against WPA2, WPA3, and Passpoint networks.
Gateway Bouncing (Routing Layer)
In many deployments, client isolation is enforced at the access point or Layer 2 switching layer, while Layer 3 routing remains unrestricted. An attacker can bypass these protections by routing traffic through the gateway:
- The attacker sends a packet to the gateway MAC address, with the victim device as the destination
- The gateway forwards the packet normally — from the network’s perspective, the packet appears to be client-to-gateway traffic, which is allowed
The victim receives the fraudulent packet, which appears to be legitimate
Port Stealing (Switching Layer)
Access points maintain association and forwarding tables mapping client MAC addresses to wireless sessions.These can be manipulated:
- An attacker spoofs a victim’s MAC address while associating through another band or SSIDs
- The access point updates its mapping and begins forwarding traffic destined for the victim to the attacker instead
In enterprise environments where multiple APs share a wired distribution system, this can occur across APs — not just within a single radio.
Why Enterprise Networks Carry Unique Risk
Home networks face a limited version of this threat. An attacker must already know the Wi-Fi password to join the network.
Enterprise networks operate differently.
Large environments often broadcast multiple SSIDs from the same access points, including:
- Corporate 802.1X networks
- Guest networks
- IoT networks
- WPA-Personal networks
This architecture creates a scenario where users on different SSIDs may share the same physical access point and forwarding infrastructure, depending on how traffic is bridged or tunneled within the network.
AirSnitch’s port stealing attack can cross these boundaries when traffic from all SSIDs is aggregated before being segmented elsewhere in the network.
For example, many enterprise deployments tunnel wireless traffic back to a central wireless LAN controller (WLC) before routing it. When traffic is tunneled (e.g., via CAPWAP) to a centralized wireless LAN controller, the effective Layer 2 domain may span the entire wireless infrastructure.
If Layer 2 boundaries are not clearly enforced before traffic aggregation, an attacker may gain visibility into traffic from other clients connected to the same infrastructure.
Is AirSnitch an Authentication Attack?
AirSnitch is fundamentally not an authentication attack.
Instead, all techniques covered in the research target how wireless traffic moves through the network stack. As a result, neither EAP-TLS nor RadSec can prevent AirSnitch attacks. Further, client isolation itself does not reliably prevent AirSnitch attacks.
These security practices instead affect what an attacker can do after gaining a man-in-the-middle position.
For example:
| Authentication Method | If Traffic Is Intercepted |
| PEAP/MSCHAPv2 | Password-based authentication material may be captured |
| EAP-TLS | Only a certificate handshake is visible |
| RadSec | RADIUS packets themselves are encrypted |
In other words, these controls limit the value of intercepted authentication traffic, but they do not eliminate the underlying wireless attack path.
The Role of VLAN Design in Preventing AirSnitch Attacks
The AirSnitch research also highlights how network segmentation architecture determines whether the attack meaningfully expands an attacker’s reach.
Key questions for network security teams to ask about their AirSnitch vulnerability include:
- Where does your Layer-2 network actually start and end?
- Are SSIDs segmented before traffic aggregation, or only later in the network?
- Where are VLAN decisions enforced — at the AP, controller, or core network?
- Can your router or controller route traffic between VLANs directly?
In some environments, VLAN segmentation reduces the potential impact significantly.
In others — particularly when VLAN routing happens centrally after wireless aggregation — segmentation may provide little practical protection.
The effectiveness of VLANs therefore depends heavily on how they are implemented within the network architecture. VLANs only provide isolation if they are enforced before traffic is bridged or aggregated; otherwise, clients may still share the same Layer 2 domain.
What to Verify in Your Environment
For IT and network security teams evaluating exposure to an AirSnitch attack, the most important checks include:
1. SSID Architecture
Avoid hosting high-security enterprise SSIDs alongside low-security networks (guest or WPA-Personal) on the same infrastructure without strong segmentation.
2. Layer 2 Scope
Understand where your Layer 2 domains extend. If wireless traffic is tunneled to a controller before segmentation, the effective broadcast domain may span the entire WLAN.
3. VLAN Enforcement Location
Determine where VLAN decisions occur:
- At the access point
- At the wireless controller
- At the network core
Segmentation earlier in the path reduces exposure.
4. Inter-VLAN routing
Review whether routers allow unrestricted routing between VLANs and whether MAC address learning or forwarding behavior allows traffic to be redirected across VLAN boundaries.
5. Authentication Method
While authentication does not stop the attack, password-based EAP methods create additional risk if traffic is intercepted.
Move to Certificate-Based Authentication for Wi-Fi
AirSnitch highlights a long-standing reality, which is that password-based authentication creates additional exposure when attackers gain network visibility.
If an attacker intercepts authentication traffic:
- Password-based protocols can expose credential material
- Certificate-based authentication exposes only TLS handshakes
SecureW2 replaces passwords with certificates across Wi-Fi, VPN, and web application access.
Our JoinNow Cloud RADIUS platform provides:
- EAP-TLS authentication
- RadSec-secured RADIUS transport
- Dynamic per-user policy enforcement
Our Dynamic PKI issues and manages the certificates used for authentication across managed and BYOD devices.
AirSnitch demonstrates that wireless isolation alone cannot be relied upon. Strong authentication and sound network architecture remain the best way to limit what an attacker can gain if wireless defenses are bypassed.
Curious to learn more about how modern security solutions from SecureW2 integrate seamlessly into your systems? Contact SecureW2 today.
