Read the docs
TI-2026-37989 Aliases CVE-2026-52893

Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook

Priority HIGH 81CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking email_verified. An attacker using an OIDC provider account with a victim's email or username can cause Wekan to merge the attacker's OIDC credentials into the victim account and then log in as that account. This issue is fixed in version 9.32.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0048 41st percentileScored 2026-11-08
Fix Fixed wekan (wekan): 9.32

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wekanwekanbefore 9.329.32Patch availableCNA
  • wekan Vendorwekan Affected before 9.32 Fixed in 9.32 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:*——wekan
  • cpe:2.3:a:wekan_project:wekan:*:*:*:*:*:*:*:* Versions — — ·wekan

Remediation

  • Fix · CNA wekan (wekan) Fixed in 9.32

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-52893

References

Other 3

  • TI-2026-40177 Improper authentication in wekan CVSS 3.1CRITICAL 9.8
  • TI-2026-48308 Improper privilege management in wekan CVSS 3.1HIGH 8.8
  • TI-2026-48305 Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446) CVSS 3.1HIGH 8.5
  • TI-2026-39911 Improper access control in wekan CVSS 3.1HIGH 8.5
  • TI-2026-01855 WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure CVSS 4.0MEDIUM 6.9
  • TI-2026-38525 Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin CVSS 4.0HIGH 7.6
See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences