# CVE-2026-55652: Wekan authentication bypass via X-Forwarded-For spoofing in header-login

Source: https://junglewise.ai/threats/cve-2026-55652-wekan-authentication-bypass-via-x-forwarded-for-spoofing-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-55652 · Severity: critical · CVSS 9.8 · Published 2026-07-15

Wekan, an open-source project management tool, contains a critical security flaw in its single sign-on (SSO) login feature. An attacker can bypass security checks by pretending to connect from a trusted network address, allowing them to log in as any user, including administrators, without a password. This could lead to a total takeover of the platform, exposing all project data and allowing unauthorized changes to tasks and user accounts.

Technologies: [WeKan](https://junglewise.ai/threats/technologies/wekan). Vendors: [WeKan](https://junglewise.ai/threats/vendors/wekan).

## Quick answers

**Is CVE-2026-55652 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55652 being exploited in the wild.

**How severe is CVE-2026-55652?** Critical severity, with a CVSS score of 9.8, published 15 July 2026.

**Which products and versions are affected?** WeKan < 9.46.

**Is there a fix for CVE-2026-55652?** A patch was published on 2026-06-15: Fix committed and version 9.46 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55652 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-55652?** Check whether you run WeKan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Wekan's header-login (reverse-proxy SSO) feature in 'server/lib/headerLoginAuth.js' incorrectly prioritizes the client-supplied 'X-Forwarded-For' header over the actual TCP socket address when validating the source IP against the 'HEADER_LOGIN_TRUSTED_IPS' allowlist. Because the 'getRequestIp()' function uses the leftmost (attacker-controlled) entry of the 'X-Forwarded-For' header, an unauthenticated attacker can spoof an allowlisted IP address. Additionally, the system fails open if the allowlist is unset. By sending a request with a spoofed IP header and a target username in the 'HEADER_LOGIN_ID' header, an attacker is issued a valid 'meteor_login_token' session. This vulnerability, dubbed 'ProxyBleed', is fixed in version 9.46 by validating the real socket address and failing closed on empty allowlists.

## Affected products

- Wekan Wekan < 9.46

## Timeline

- 2026-06-15: patched: Fix committed and version 9.46 released.
- 2026-07-15: disclosed: CVE-2026-55652 published.

## References

- [https://github.com/wekan/wekan/commit/b181889a565254bc9bf79379a34fc7f617ccda28](https://github.com/wekan/wekan/commit/b181889a565254bc9bf79379a34fc7f617ccda28)
- [https://github.com/wekan/wekan/releases/tag/v9.46](https://github.com/wekan/wekan/releases/tag/v9.46)
- [https://github.com/wekan/wekan/security/advisories/GHSA-jggc-qvfc-jr6x](https://github.com/wekan/wekan/security/advisories/GHSA-jggc-qvfc-jr6x)

## Related threats

- [Wekan ReDoS in user search via unescaped regex](https://junglewise.ai/threats/cve-2026-119300-wekan-is-open-source-kanban-built-with-meteor-prior-to-11-11-the)
- [Wekan broken access control in DDP update rules](https://junglewise.ai/threats/cve-2026-55234-wekan-broken-access-control-in-ddp-update-rules)
- [Wekan missing authorization in cloneBoard method](https://junglewise.ai/threats/cve-2026-53447-wekan-missing-authorization-in-cloneboard-method)
- [Wekan SSRF in webhook integration URLs](https://junglewise.ai/threats/cve-2026-53446-wekan-ssrf-in-webhook-integration-urls)
- [Wekan missing authorization in copyBoard DDP method](https://junglewise.ai/threats/cve-2026-53445-wekan-missing-authorization-in-copyboard-ddp-method)