CVE-2026-52893
Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking email_verified. An attacker using an OIDC provider account with a victim's email or username can cause Wekan to merge the attacker's OIDC credentials into the victim account and then log in as that account. This issue is fixed in version 9.32.
- Score
- CVSS 4.0 9.2 Critical
- Status
- Deferred - security-advisories@github.com
- Published
- 2026-07-15
- Last modified
- 2026-07-18
- Weaknesses
- CWE-287
Affected products
References
- https://github.com/wekan/wekan/commit/73204d4e0a7d77a1b186b3d76e8eaf2f3e7c9fd9
- https://github.com/wekan/wekan/releases/tag/v9.32
- https://github.com/wekan/wekan/security/advisories/GHSA-mp7g-hj5q-gxhq
