Back to overview

CVE-2026-52893

CRITICAL
9.2
CVSS 4.0
Description
Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking email_verified. An attacker using an OIDC provider account with a victim's email or username can cause Wekan to merge the attacker's OIDC credentials into the victim account and then log in as that account. This issue is fixed in version 9.32.

Metadata

CVE ID
CVE-2026-52893
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-06-08 21:44 UTC
Published
2026-07-15 21:12 UTC
Last updated
2026-07-15 21:12 UTC
Primary CWE
CWE-287
CWE-287: Improper Authentication
Vendor / Product
wekan / wekan
Sources
cve.org  ·  NVD

Severity & Metrics

9.2 CRITICAL CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Affected products (1)
VendorProductPlatformVersions
wekan wekan — < 9.32
Weakness (CWE)
CWESourceDescription
CWE-287 cna CWE-287: Improper Authentication
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.2 CRITICAL 4.0 cna CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
References (3)
Back to overview