CVE-2026-75774
Received Received - Intake

Improper Authentication in Karakeep App up to 0.32.0

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulDB

Description
A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-75774
EUVD
EUVD-2026-60582

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
karakeep-app karakeep to 0.32.0 (inc)
karakeep karakeep to 0.32.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-75774 is an authentication bypass vulnerability in Karakeep (formerly Hoarder) up to version 0.32.0. The issue occurs in the OAuth sign-in process where email verification is not enforced despite a server-wide policy requiring it. This allows attackers to log in without verifying their email address if the OAuth provider permits unverified emails.

Detection Guidance

Check the Karakeep application logs for failed authentication attempts or unusual OAuth sign-in patterns. Review the auth.ts file in apps/web/server/auth.ts for missing email verification checks in the OAuth branch. Verify if EMAIL_VERIFICATION_REQUIRED is set to true but OAuth sign-ins bypass this requirement.

Impact Analysis

This vulnerability allows unauthorized users to access accounts without email verification, potentially leading to data breaches or unauthorized access to sensitive information like bookmarks, notes, or files stored in Karakeep. It specifically affects instances where OAuth is configured and email verification is required.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and user authentication, such as GDPR's data protection principles or HIPAA's access controls. Unauthorized access risks exposing personal or sensitive data, leading to potential legal and regulatory penalties.

Mitigation Strategies

Update the auth.ts file to enforce email verification for all login methods, including OAuth. Ensure the email_verified claim from OIDC providers is explicitly validated. Temporarily disable OAuth sign-in if email verification cannot be enforced until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75774. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart