CVE-2026-52893
CriticalCVSS 9.2Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In Wekan prior to version 9.32, the Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking email_verified. An attacker using an OIDC provider account with a victim's email or username can cause Wekan to merge the attacker's OIDC credentials into the victim account and then log in as that account.
Risk Assessment
The risk is that an attacker who knows the victim's email or username and has an account at an OIDC provider can take over the victim's Wekan account, leading to unauthorized access to data and functionality within the Wekan system.
Recommendation
Immediately upgrade Wekan to version 9.32 or later, which contains the fix for this vulnerability. After upgrading, verify that no unauthorized account merges have occurred.
Original NVD description (English source)
Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking email_verified. An attacker using an OIDC provider account with a victim's email or username can cause Wekan to merge the attacker's OIDC credentials into the victim account and then log in as that account. This issue is fixed in version 9.32.