karakeep vulnerabilities

A vulnerability in karakeep-app karakeep up to 0.32.0 affects an unknown function in apps/web/server/auth.ts of the OAuth Sign-In component. Manipulation causes improper authentication. The attack can be initiated remotely but is difficult to exploit. The exploit has been publicly disclosed.

A vulnerability was found in karakeep up to 0.32.0 in the authorize function of the auth.ts file in the Login Endpoint component. The manipulation results in improper restriction of excessive authentication attempts. The attack can be performed remotely but is characterized by high complexity and difficult exploitability. The exploit is public.

In Karakeep before 0.32.0, an SSRF protection bypass was identified via crafted HTTP redirects. An authenticated user can initiate requests to internal Docker services.