Karakeep CVE-2026-75774

Exploitation requires that the Karakeep OAuth Sign-In feature is enabled and that the Karakeep web interface is reachable from the attacker's network (AV:N). No credentials are required (PR:N) and no victim user interaction is needed (UI:N). However, high attack complexity (AC:H) means the attacker must engineer specific conditions in the OAuth flow - likely precise timing, state manipulation, or crafted callback parameters targeting the logic in apps/web/server/auth.ts - rather than sending a single unauthenticated request. Exploitation is bounded to low integrity impact on the vulnerable Karakeep instance (VI:L) with no documented confidentiality or availability consequence and no impact on subsequent systems. Limiting factors include: the high attack complexity requirement, the self-hosted and often non-internet-facing deployment model of Karakeep, and the absence of a known fully weaponized automated exploit chain at time of analysis.

The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N) places this as a remotely reachable, unauthenticated flaw with high complexity and a constrained impact ceiling of low integrity - no confidentiality or availability loss is documented. The 6.3 CVSS 4.0 score reflects the E:P threat metric (proof-of-concept available), which inflates urgency relative to an unexploited finding at similar impact levels. EPSS data was not provided in the available intelligence, so probabilistic exploitation rate cannot be quantified. This is not a CISA KEV entry, meaning active exploitation at scale has not been confirmed by a government threat feed. The combination of a public PoC, no vendor patch, and an authentication bypass in an OAuth flow is a meaningful risk signal even absent KEV listing - even a mid-sized municipal IT team in zabrze running Karakeep for internal knowledge management should treat this as a prioritized compensating-control task until the vendor confirms a remediation. The high attack complexity is the primary moderating factor: exploitation is not trivial or automatable at scale, reducing risk of opportunistic mass exploitation while still permitting targeted abuse by a motivated adversary familiar with OAuth attack patterns.

An attacker who has studied the Karakeep OAuth callback flow crafts a manipulated request to the auth.ts handler - for example, forging or replaying OAuth state parameters or tampering with identity claim values - to satisfy authentication checks without presenting valid credentials. A public proof-of-concept has been disclosed via GitHub issue #2920, providing a starting point for an attacker willing to invest in the high-complexity exploitation path. Upon success, the attacker gains authenticated access to a Karakeep user account, potentially accessing bookmarks, archived content, and any data stored within that user's workspace.