CVE-2026-55652
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Wekan before version 9.46 has a vulnerability in the header-login mechanism where getRequestIp() trusts the client-supplied X-Forwarded-For header before the real socket address. This allows an unauthenticated attacker to impersonate any user, including admin, by sending a HEADER_LOGIN_ID header and obtaining a meteor_login_token session.
Risk Assessment
An attacker can take over the admin account, leading to full compromise of the Wekan system, including access to all boards, cards, and user data.
Recommendation
Immediately update Wekan to version 9.46 or later. If updating is not possible, disable the header-login feature or configure HEADER_LOGIN_TRUSTED_IPS to include only trusted IP addresses.
Original NVD description (English source)
Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED_IPS uses getRequestIp() in server/lib/headerLoginAuth.js to trust the client-supplied X-Forwarded-For header before the real socket address, allowing an unauthenticated attacker to send HEADER_LOGIN_ID for any username and receive a meteor_login_token session, including for admin. This issue is fixed in version 9.46.