What is the CVSS score of CVE-2026-55652?

CVE-2026-55652 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Wekan are affected by CVE-2026-55652?

Wekan kanban platform before version 9.46 contains a critical authentication bypass allowing unauthenticated attackers to impersonate any user account, including administrators, through HTTP header…

How to fix or mitigate CVE-2026-55652?

Within 24 hours, identify all Wekan deployments and their current versions; for instances running versions prior to 9.46, immediately implement network-level controls restricting HTTP access to trusted internal sources only and disable the header-login authentication feature if operationally feasible. Within 7 days, confirm patch release timeline with the Wekan vendor, implement reverse proxy controls to validate X-Forwarded-For headers against a whitelist of known trusted proxy IPs only, and deploy comprehensive audit logging for all authentication events. Within 30 days, deploy the vendor patch to Wekan 9.46 or later when available, and conduct a forensic review of authentication logs covering the entire vulnerable period to identify any unauthorized account access or privilege escalation.

Wekan CVE-2026-55652

CRITICAL

Improper Authentication (CWE-287)

2026-07-15 GitHub_M

Authentication Bypass Wekan

9.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Reachable over the network with a single spoofed header and no auth or interaction (AV:N/AC:L/PR:N/UI:N); admin takeover yields full C/I/A, presuming the non-default header-login feature is enabled.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 22:05 vuln.today

Analysis Generated

Jul 15, 2026 - 22:05 vuln.today

CVE Published

Jul 15, 2026 - 21:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED_IPS uses getRequestIp() in server/lib/headerLoginAuth.js to trust the client-supplied X-Forwarded-For header before the real socket address, allowing an unauthenticated attacker to send HEADER_LOGIN_ID for any username and receive a meteor_login_token session, including for admin. This issue is fixed in version 9.46.

AnalysisAI

Authentication bypass in Wekan (open-source Meteor kanban) before version 9.46 lets an unauthenticated attacker impersonate any account, including admin. The header-login feature's getRequestIp() in server/lib/headerLoginAuth.js trusts the client-supplied X-Forwarded-For header instead of the real TCP socket peer, so an attacker who can reach the HTTP port can spoof a trusted source IP and submit HEADER_LOGIN_ID for any username to receive a valid meteor_login_token session. Tracked by the vendor as 'ProxyBleed' (GHSA-jggc-qvfc-jr6x); CVSS 9.8. No public exploit identified at time of analysis and not listed in CISA KEV.

Technical ContextAI

Wekan is a self-hosted kanban board built on the Meteor JavaScript framework, typically deployed behind a reverse proxy that terminates TLS and can perform SSO. The affected 'header login' feature (SiteMinder-style reverse-proxy SSO) is designed to trust an upstream proxy to authenticate a user and pass the identity in an HTTP header (e.g. X-Auth-User via HEADER_LOGIN_ID). The security of this model depends entirely on correctly identifying the source of the request. The root cause is CWE-287 (Improper Authentication): the vulnerable getRequestIp() derived the 'source IP' from the attacker-controllable X-Forwarded-For request header rather than the real TCP connection peer, and an empty HEADER_LOGIN_TRUSTED_IPS allowlist was treated as 'trust all sources' instead of failing closed. The affected CPE is cpe:2.3:a:wekan:wekan:*:*:*:*:*:*:*:* for all versions prior to 9.46.

RemediationAI

Vendor-released patch: 9.46 - upgrade Wekan to v9.46 or later (https://github.com/wekan/wekan/releases/tag/v9.46), which reads the source IP from the real TCP socket peer and fails closed when HEADER_LOGIN_TRUSTED_IPS is empty. After upgrading you must set HEADER_LOGIN_TRUSTED_IPS to your reverse proxy's IP address(es) or header login authenticates no one; for multi-hop proxy chains, additionally set HEADER_LOGIN_TRUSTED_PROXIES to the intermediate proxy IPs so X-Forwarded-For is honored only when the immediate TCP peer is trusted. If you cannot upgrade immediately, disable header login entirely by unsetting HEADER_LOGIN_ID (trade-off: reverse-proxy SSO stops working and users fall back to password login), and use network controls so only the reverse proxy can reach Wekan's HTTP port, blocking direct client connections that could spoof X-Forwarded-For. Rotate any admin credentials and invalidate sessions that may have been abused. See advisory GHSA-jggc-qvfc-jr6x for details.