Vulnerability · Published Jul 15, 2026 · Assigned by GitHub_M

CVE-2026-52893Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook

Critical 9.2

In plain English

A critical-severity improper authentication in wekan from wekan. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 4.0)9.2Critical

Exploit odds (30 days)0.5%top 58.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking email_verified. An attacker using an OIDC provider account with a victim's email or username can cause Wekan to merge the attacker's OIDC credentials into the victim account and then log in as that account. This issue is fixed in version 9.32.

Affected products (as reported)

Vendor	Product	Versions
wekan	wekan	< 9.32

Weakness: CWE-287 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

References

https://github.com/wekan/wekan/security/advisories/GHSA-mp7g-hj5q-gxhq x_refsource_CONFIRM
https://github.com/wekan/wekan/commit/73204d4e0a7d77a1b186b3d76e8eaf2f3e7c9fd9 x_refsource_MISC
https://github.com/wekan/wekan/releases/tag/v9.32 x_refsource_MISC