Authentication Bypass by Spoofing in Wekan - CVE-2026-55652
Published: July 28, 2026
Vulnerability identifier: #VU139853
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-55652
CWE-ID: CWE-290
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to take over arbitrary accounts, including administrative accounts.
The vulnerability exists due to improper access control in the header-login authentication mechanism when processing requests that supply a spoofed X-Forwarded-For header and a chosen header-login username. A remote attacker can send a specially crafted GET request to take over arbitrary accounts, including administrative accounts.
Exploitation requires the header-login feature to be enabled and the attacker to be able to reach the Wekan HTTP port directly without traversing the trusted reverse proxy.
Affected software
Wekan
How to mitigate CVE-2026-55652
Install security update from vendor's website.
Wekan - update to 9.46