Improper Authentication in Wekan - CVE-2026-52893
Published: July 28, 2026
Vulnerability identifier: #VU139860
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-52893
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to take over another user's account.
The vulnerability exists due to improper authentication in the Accounts.onCreateUser hook in server/models/users.js when processing OIDC login claims that match an existing user's email address or username. A remote attacker can authenticate through the configured OIDC provider with specially crafted claims to take over another user's account.
Only deployments with OIDC authentication enabled are vulnerable. No victim interaction is required, and administrative accounts can also be taken over.
Affected software
Wekan
How to mitigate CVE-2026-52893
Install security update from vendor's website.
Wekan - update to 9.32