CVE-2026-52893

Deferred Deferred - Pending Action

Account Takeover via OIDC Login Merging in Wekan

Publication date: 2026-07-15

Last updated on: 2026-07-18

Assigner: GitHub, Inc.

Description

Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking email_verified. An attacker using an OIDC provider account with a victim's email or username can cause Wekan to merge the attacker's OIDC credentials into the victim account and then log in as that account. This issue is fixed in version 9.32.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-18

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-52893

Affected Vendors & Products

Vendor	Product	Version / Range
wekan	wekan	9.32

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability in Wekan allows an attacker to take over a victim's account by using an OIDC provider account with the victim's email or username. The system merges OIDC logins into existing accounts without verifying ownership or checking if the email is verified, enabling unauthorized access.

Detection Guidance

To detect this vulnerability, check if your Wekan instance is running a version prior to 9.32. Use commands like 'docker ps' or 'kubectl get pods' to inspect running containers and verify the Wekan version. Look for unexpected merged accounts in the admin panel or database.

Impact Analysis

If you use Wekan with OIDC authentication, an attacker could gain access to your account by exploiting this flaw. This could lead to unauthorized access to your kanban boards, sensitive data, or other account-related information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, potentially violating GDPR or HIPAA compliance. Organizations using Wekan may face legal or regulatory penalties if user data is compromised due to this issue.

Mitigation Strategies

Upgrade Wekan to version 9.32 or later to address the vulnerability. Review OIDC login configurations to ensure proper email verification and ownership checks are enforced.

Hi! I’m here to help you understand CVE-2026-52893. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70