CVE-2026-55652 | Wekan is open source kanban built with Meteor. Prior to 9.46… | CVSS 9.8 CRITICAL

Description

Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED_IPS uses getRequestIp() in server/lib/headerLoginAuth.js to trust the client-supplied X-Forwarded-For header before the real socket address, allowing an unauthenticated attacker to send HEADER_LOGIN_ID for any username and receive a meteor_login_token session, including for admin. This issue is fixed in version 9.46.

Metadata

CVE ID: CVE-2026-55652
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-16 23:52 UTC
Published: 2026-07-15 21:15 UTC
Last updated: 2026-07-15 21:15 UTC
Primary CWE: CWE-287
CWE-287: Improper Authentication
Vendor / Product: wekan / wekan
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products (1)

Vendor	Product	Platform	Versions
wekan	wekan	—	< 9.46

Weakness (CWE)

CWE	Source	Description
CWE-287	cna	CWE-287: Improper Authentication
CWE-290	cna	CWE-290: Authentication Bypass by Spoofing

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (3)

https://github.com/wekan/wekan/security/advisories/GHSA-jggc-qvfc-jr6x https://github.com/wekan/wekan/security/advisories/GHSA-jggc-qvfc-jr6x
https://github.com/wekan/wekan/commit/b181889a565254bc9bf79379a34fc7f617ccda28 https://github.com/wekan/wekan/commit/b181889a565254bc9bf79379a34fc7f617ccda28
https://github.com/wekan/wekan/releases/tag/v9.46 https://github.com/wekan/wekan/releases/tag/v9.46