Wekan
CVE-2026-55652
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Wekan HTTP port directly
-
DeliveryCraft request spoofing X-Forwarded-For
-
ExploitSet HEADER_LOGIN_ID header to 'admin'
-
ExecutionServer trusts forwarded IP, accepts identity
-
PersistReceive meteor_login_token session
-
ImpactFull admin account takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a Wekan version prior to 9.46 AND header login enabled (HEADER_LOGIN_ID set to an identity header name); this SSO feature is off by default, which is the primary limiting factor. Given those conditions, exploitation needs no authentication and no user interaction: the attacker needs only network reachability to Wekan's HTTP port and spoofs the X-Forwarded-For header (plus supplies the configured identity header with any username). Before v9.45 an empty/unset HEADER_LOGIN_TRUSTED_IPS trusted every source IP, so no valid proxy IP even had to be guessed. What limits it: deployments that never enabled header login are not vulnerable, and environments where only the reverse proxy can reach the HTTP port reduce the direct-spoofing path. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) reflects a worst-case network, unauthenticated, low-complexity full compromise, and the mechanics support that severity: spoofing a single HTTP header yields an admin session. The one signal that tempers real-world risk is a deployment precondition not captured in the base score - the header-login feature must be explicitly enabled (HEADER_LOGIN_ID configured), which is not the default for most Wekan installs, so the exposed population is narrower than 9.8 implies. No EPSS score was provided in the input, and the CVE is not in CISA KEV, so there is no evidence of active or automated exploitation; the ProxyBleed writeup documents the flaw but no public exploit code is referenced. Net: genuinely critical for the subset running reverse-proxy header SSO, but low practical risk for default deployments that never enabled the feature. Verify whether header login is configured before prioritizing. |
| Exploit ScenarioDerived | On a pre-9.46 Wekan instance with header login enabled, an attacker who can reach the HTTP port sends a request setting X-Forwarded-For to an IP the server treats as trusted (or exploits the empty-allowlist 'trust all' default) together with the identity header HEADER_LOGIN_ID set to 'admin'. Wekan mistakes the spoofed forwarded IP for the real source, accepts the header identity, and returns a meteor_login_token, granting an authenticated admin session without any credentials. No public exploit code is identified, but the technique needs only a single crafted HTTP request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 15, 2026
Authentication bypass in Wekan (open-source Meteor kanban) before version 9.46 lets an unauthenticated attacker impersonate any account, including admin. The header-login feature's getRequestIp() in server/lib/headerLoginAuth.js trusts the client-supplied X-Forwarded-For header instead of the real TCP socket peer, so an attacker who can reach the HTTP port can spoof a trusted source IP and submit HEADER_LOGIN_ID for any username to receive a valid meteor_login_token session. Tracked by the vendor as 'ProxyBleed' (GHSA-jggc-qvfc-jr6x); CVSS 9.8. No public exploit identified at time of analysis and not listed in CISA KEV.
RemediationAI
Vendor-released patch: 9.46 - upgrade Wekan to v9.46 or later (https://github.com/wekan/wekan/releases/tag/v9.46), which reads the source IP from the real TCP socket peer and fails closed when HEADER_LOGIN_TRUSTED_IPS is empty. After upgrading you must set HEADER_LOGIN_TRUSTED_IPS to your reverse proxy's IP address(es) or header login authenticates no one; for multi-hop proxy chains, additionally set HEADER_LOGIN_TRUSTED_PROXIES to the intermediate proxy IPs so X-Forwarded-For is honored only when the immediate TCP peer is trusted. If you cannot upgrade immediately, disable header login entirely by unsetting HEADER_LOGIN_ID (trade-off: reverse-proxy SSO stops working and users fall back to password login), and use network controls so only the reverse proxy can reach Wekan's HTTP port, blocking direct client connections that could spoof X-Forwarded-For. Rotate any admin credentials and invalidate sessions that may have been abused. See advisory GHSA-jggc-qvfc-jr6x for details.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Wekan is a self-hosted kanban board built on the Meteor JavaScript framework, typically deployed behind a reverse proxy that terminates TLS and can perform SSO. The affected 'header login' feature (SiteMinder-style reverse-proxy SSO) is designed to trust an upstream proxy to authenticate a user and pass the identity in an HTTP header (e.g. X-Auth-User via HEADER_LOGIN_ID). The security of this model depends entirely on correctly identifying the source of the request. The root cause is CWE-287 (Improper Authentication): the vulnerable getRequestIp() derived the 'source IP' from the attacker-controllable X-Forwarded-For request header rather than the real TCP connection peer, and an empty HEADER_LOGIN_TRUSTED_IPS allowlist was treated as 'trust all sources' instead of failing closed. The affected CPE is cpe:2.3:a:wekan:wekan:*:*:*:*:*:*:*:* for all versions prior to 9.46.
Know when Wekan gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reachable over the network with a single spoofed header and no auth or interaction (AV:N/AC:L/PR:N/UI:N); admin takeover yields full C/I/A, presuming the non-default header-login feature is enabled.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED_IPS uses getRequestIp() in server/lib/headerLoginAuth.js to trust the client-supplied X-Forwarded-For header before the real socket address, allowing an unauthenticated attacker to send HEADER_LOGIN_ID for any username and receive a meteor_login_token session, including for admin. This issue is fixed in version 9.46.
Executive ViewAI
Wekan kanban platform before version 9.46 contains a critical authentication bypass allowing unauthenticated attackers to impersonate any user account, including administrators, through HTTP header spoofing. Organizations running affected versions face immediate risk of complete account compromise and unauthorized administrative access to their collaboration platforms.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) Restrict network access to Wekan instances to internal sources only; (2) Disable the header-login feature if not operationally required; (3) Implement reverse proxy header validation to enforce X-Forwarded-For against known trusted IPs; (4) Deploy real-time alerting on authentication anomalies and administrative account access attempts; (5) Require multi-factor authentication for all user accounts as an additional compensating control.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by t
OS command injection in Wekan (the open-source Meteor-based kanban board) before version 9.07 lets an authenticated user
A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticate
Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scrip
Account takeover in Wekan (open-source Meteor kanban) before 9.32 allows an attacker who controls an OIDC provider accou
Privilege escalation in Wekan open-source kanban (all versions prior to 9.89, dubbed 'SortBleed') allows any board membe
Privilege escalation in the self-hosted Wekan kanban board through version 18.15 allows any authenticated user to rewrit
Stored XSS in Wekan prior to v9.90 allows authenticated board members to upload HTML containing JavaScript disguised as
LDAP filter injection in WeKan before 8.19 allows remote unauthenticated attackers to manipulate LDAP search filters and
Privilege escalation in WeKan (versions prior to 8.35) allows authenticated board members with low privileges to perform
Wekan's outgoing webhook URL validator in versions 8.36 through 9.73 allows authenticated board members to bypass SSRF p
Improper access control in Wekan (self-hosted open-source Meteor kanban) before version 9.37 lets any authenticated user
Exploit-DB