CVE-2026-55652
Received Received - Intake

Wekan Session Hijack via X-Forwarded-For Header

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description
Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED_IPS uses getRequestIp() in server/lib/headerLoginAuth.js to trust the client-supplied X-Forwarded-For header before the real socket address, allowing an unauthenticated attacker to send HEADER_LOGIN_ID for any username and receive a meteor_login_token session, including for admin. This issue is fixed in version 9.46.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-15
Last Modified
2026-07-15
Generated
2026-07-16
AI Q&A
2026-07-16
EPSS Evaluated
N/A
NVD
CVE-2026-55652

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wekan wekan 9.46

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Wekan, a Meteor-based open source kanban tool, allows an unauthenticated attacker to impersonate any user, including administrators, by exploiting a flawed IP trust mechanism. The issue occurs in the header-login feature which incorrectly trusts the X-Forwarded-For header before validating the real client IP address.

Impact Analysis

An attacker could gain full access to any user account, including admin accounts, allowing them to view, modify, or delete sensitive data. This could lead to data breaches, unauthorized changes to projects, or complete system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using affected Wekan versions may face compliance violations and potential fines.

Mitigation Strategies

Upgrade Wekan to version 9.46 or later to address the vulnerability in header-login authentication.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55652. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart