Wakapi CVE-2026-97737

Exploitation requires a Wakapi deployment before 2.17.6 that uses the user caching service, where cache entries share a common key namespace allowing one user's lookup to resolve to another user's cached record. Realistically this needs a multi-user instance so a victim account exists to collide with, and the AC:H rating reflects that the attacker must induce or await the specific cache state where lookups cross contexts - it is not a single deterministic request. No authentication or user interaction is required (PR:N/UI:N). Upgrading to 2.17.6 (fix commit ce91eac) fully remediates.

This is a genuine high-priority logic flaw despite a moderate CVSS of 7.4. The NVD vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) shows a network-reachable, unauthenticated (PR:N) path with high confidentiality and integrity impact - consistent with the vendor's own characterization of a 'Critical authentication bypass due to shared cache key namespace' and the description's 'account takeover' outcome. The one dampening signal is AC:H: the bug depends on a cache lookup resolving in an unintended namespace/context, which is not fully attacker-deterministic, so exploitation is opportunistic or requires engineering specific cache-collision conditions rather than a single reliable request. No EPSS score, no CISA KEV listing, and no public exploit are provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - but a fix commit (ce91eac) and advisory (GHSA-x48w-3rq3-w2pq) are public, which typically shortens the window to a working exploit. Note a conflict in the input metadata: the vendor calls this 'Critical' while NVD scores it 7.4 (High) and CWE-843 (type confusion) is a loose fit for what is really a cache-key-namespace collision - treat the vendor 'Critical' label as severity emphasis, not an independent CVSS.

A remote, unauthenticated attacker interacts with a self-hosted Wakapi instance (before 2.17.6) so that the user caching service resolves their lookup against another user's cached entry due to a shared cache key namespace, returning or acting under that victim's identity and yielding account takeover. Because the flaw is a cache-collision condition (AC:H), the attacker may need to time requests or induce specific cache states rather than exploit deterministically. No public exploit code is available, but the fix commit and security advisory disclose the affected code path.