EUVD-2026-60582
GHSA-g3wj-5278-jq3m
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable OAuth bypass requiring no credentials but high complexity; integrity impact is low and scoped to the vulnerable system only with no confidentiality or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
OAuth Sign-In bypass in Karakeep up to version 0.32.0 allows unauthenticated remote attackers to subvert the authentication process via manipulation of logic in apps/web/server/auth.ts, achieving a low-integrity impact on the vulnerable system without requiring credentials or user interaction. High attack complexity (AC:H) means exploitation demands engineered conditions in the OAuth callback flow rather than trivial exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Karakeep OAuth Sign-In feature is enabled and that the Karakeep web interface is reachable from the attacker's network (AV:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N) places this as a remotely reachable, unauthenticated flaw with high complexity and a constrained impact ceiling of low integrity - no confidentiality or availability loss is documented. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has studied the Karakeep OAuth callback flow crafts a manipulated request to the auth.ts handler - for example, forging or replaying OAuth state parameters or tampering with identity claim values - to satisfy authentication checks without presenting valid credentials. A public proof-of-concept has been disclosed via GitHub issue #2920, providing a starting point for an attacker willing to invest in the high-complexity exploitation path. … |
| Remediation | No vendor-released patch identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored cross-site scripting in Karakeep 0.30.0 allows remote attackers to execute arbitrary JavaScript in users' browser
Server-side request forgery in Karakeep self-hosted bookmark manager versions prior to 0.32.0 allows authenticated users
Unlimited authentication attempts against the karakeep login endpoint (apps/web/server/auth.ts) in versions up to 0.32.0
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today