Executive brief
Wekan, an open-source Kanban board application, is vulnerable to account takeover when configured to use OpenID Connect (OIDC) for logins. An attacker can gain full control of a victim's account by logging in through an OIDC provider with a matching email address or username. This allows the attacker to access all of the victim's private boards, cards, and attachments, and potentially gain administrative privileges without the victim's knowledge or interaction.
Technical details
A vulnerability exists in the Wekan 'Accounts.onCreateUser' hook within 'server/models/users.js'. When a user logs in via OIDC, the application searches for existing accounts with a matching email or username and unconditionally merges the new OIDC credentials into the existing record. The application fails to verify the 'email_verified' claim from the OIDC provider or perform any ownership challenge. An attacker can use a self-hosted or misconfigured OIDC provider to present a victim's email or username, causing Wekan to overwrite the victim's account data and grant the attacker access. This issue is resolved in version 9.32 by disabling automatic merging by default and requiring 'email_verified' claims when merging is enabled.
Affected products
- Wekan Wekan < 9.32
Timeline
- 2026-05-30: advisory: GHSA-mp7g-hj5q-gxhq published by maintainers
- 2026-05-31: patched: Fixed in version 9.32
- 2026-07-15: disclosed: CVE-2026-52893 published to NVD