Improper Authentication in Wekan - CVE-2026-52893
Published: July 28, 2026
Vulnerability identifier: #VU139860
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2026-52893
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: wekan.github.io
Affected software:
Wekan
Wekan
Detailed vulnerability description
The vulnerability allows a remote attacker to take over another user's account.
The vulnerability exists due to improper authentication in the Accounts.onCreateUser hook in server/models/users.js when processing OIDC login claims that match an existing user's email address or username. A remote attacker can authenticate through the configured OIDC provider with specially crafted claims to take over another user's account.
Only deployments with OIDC authentication enabled are vulnerable. No victim interaction is required, and administrative accounts can also be taken over.
How to mitigate CVE-2026-52893
Install security update from vendor's website.