CVE-2026-75774
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A vulnerability in karakeep-app karakeep up to 0.32.0 affects an unknown function in apps/web/server/auth.ts of the OAuth Sign-In component. Manipulation causes improper authentication. The attack can be initiated remotely but is difficult to exploit. The exploit has been publicly disclosed.
Risk Assessment
Improper authentication may allow unauthorized access to user accounts, potentially leading to data confidentiality breaches.
Recommendation
Monitor the project for patches and consider temporary mitigations to restrict access to OAuth Sign-In.
Other vulnerabilities in karakeep
See all- CVE-2026-75773Low
A vulnerability was found in karakeep up to 0.32.0 in the authorize function of the auth.ts file in the Login Endpoint component. The manipulation results in improper restriction of excessive authentication attempts. The attack can be performed remotely but is characterized by high complexity and difficult exploitability. The exploit is public.
- CVE-2026-45082High
In Karakeep before 0.32.0, an SSRF protection bypass was identified via crafted HTTP redirects. An authenticated user can initiate requests to internal Docker services.
Original NVD description (English source)
A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS