Which versions of Wekan are affected by CVE-2026-52893?

Wekan versions before 9.32 contain a critical account takeover vulnerability in OIDC authentication that allows attackers controlling an identity provider account to hijack victim Wekan accounts and…

How to fix or mitigate CVE-2026-52893?

Within 24 hours, identify all Wekan deployments running versions before 9.32 and temporarily disable OIDC authentication, reverting to local account authentication; terminate all active OIDC sessions. Within 7 days, upgrade all affected Wekan instances to version 9.32 and test OIDC authentication workflows to confirm functionality. Within 30 days, audit all Wekan user accounts for unauthorized access indicators, revoke and regenerate all API tokens issued to OIDC-authenticated accounts, review audit logs for suspicious OIDC provider assertions, and implement multi-factor authentication (MFA) if available to strengthen account protection.

Wekan CVE-2026-52893

Q: What is the CVSS score of CVE-2026-52893?

CVE-2026-52893 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

CRITICAL

Improper Authentication (CWE-287)

2026-07-15 GitHub_M

Authentication Bypass Wekan

9.2

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 22:04 vuln.today

Analysis Generated

Jul 15, 2026 - 22:04 vuln.today

CVE Published

Jul 15, 2026 - 21:12 cve.org

CRITICAL 9.2

DescriptionCVE.org

Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking email_verified. An attacker using an OIDC provider account with a victim's email or username can cause Wekan to merge the attacker's OIDC credentials into the victim account and then log in as that account. This issue is fixed in version 9.32.

AnalysisAI

Account takeover in Wekan (open-source Meteor kanban) before 9.32 allows an attacker who controls an OIDC provider account asserting a victim's email or username to hijack the victim's existing Wekan account. The vulnerable Accounts.onCreateUser hook in server/models/users.js merged incoming OIDC identities into any local account whose email OR username matched, without verifying ownership or checking email_verified, letting the attacker inherit the victim's boards, attachments, API tokens, and admin status. No public exploit identified at time of analysis, but the fix is confirmed in version 9.32 and the flaw carries a CVSS 4.0 base score of 9.2 (critical).