Executive brief
Wekan, an open-source project management tool, contains a critical security flaw in its single sign-on (SSO) login feature. An attacker can bypass security checks by pretending to connect from a trusted network address, allowing them to log in as any user, including administrators, without a password. This could lead to a total takeover of the platform, exposing all project data and allowing unauthorized changes to tasks and user accounts.
Technical details
Wekan's header-login (reverse-proxy SSO) feature in 'server/lib/headerLoginAuth.js' incorrectly prioritizes the client-supplied 'X-Forwarded-For' header over the actual TCP socket address when validating the source IP against the 'HEADER_LOGIN_TRUSTED_IPS' allowlist. Because the 'getRequestIp()' function uses the leftmost (attacker-controlled) entry of the 'X-Forwarded-For' header, an unauthenticated attacker can spoof an allowlisted IP address. Additionally, the system fails open if the allowlist is unset. By sending a request with a spoofed IP header and a target username in the 'HEADER_LOGIN_ID' header, an attacker is issued a valid 'meteor_login_token' session. This vulnerability, dubbed 'ProxyBleed', is fixed in version 9.46 by validating the real socket address and failing closed on empty allowlists.
Affected products
- Wekan Wekan < 9.46
Timeline
- 2026-06-15: patched: Fix committed and version 9.46 released.
- 2026-07-15: disclosed: CVE-2026-55652 published.