CVE-2026-52893: Wekan Authentication Bypass Vulnerability

CVE-2026-52893 Overview

CVE-2026-52893 is an authentication bypass vulnerability in Wekan, an open source kanban board built with Meteor. Versions prior to 9.32 contain a flaw in the Accounts.onCreateUser hook in server/models/users.js that merges OpenID Connect (OIDC) logins into existing accounts when the OIDC email or username matches an existing Wekan user. The hook performs this merge without verifying ownership or checking the email_verified claim. An attacker controlling an OIDC provider account with a victim's email address or username can force Wekan to link attacker credentials into the victim account and log in as that user. The issue is fixed in version 9.32.

Critical Impact
Full account takeover, including access to victim boards, attachments, API tokens, and administrative privileges, achievable remotely by any attacker holding an OIDC identity matching a target user.

Affected Products

Wekan versions prior to 9.32
Deployments integrating OIDC / OAuth2 authentication via the wekan-oidc package
Self-hosted Wekan instances relying on federated identity providers

Discovery Timeline

2026-07-15 - CVE-2026-52893 published to the National Vulnerability Database
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-52893

Vulnerability Analysis

The vulnerability is an improper authentication flaw classified as [CWE-287]. Wekan's OIDC integration trusts identity claims presented by any configured OIDC provider without validating whether the provider has verified the email address or whether the presenter owns the matching Wekan account. When a new OIDC login arrives, the Accounts.onCreateUser hook searches for existing users by either emails.address or username and merges the incoming identity into the first match. The attacker inherits the victim's _id, board memberships, attachments, API tokens, and administrator status. Any user able to register an account on a trusted OIDC provider using arbitrary email or username values can complete the takeover with a single authentication flow.

Root Cause

The root cause is a fail-open authentication design in server/models/users.js. The lookup query $or: [{ 'emails.address': email }, { username: user.username }] conflates identity assertion with identity ownership. Username matching carries no cryptographic or provider-side proof of ownership, and the code never inspects the email_verified claim returned by the OIDC provider.

Attack Vector

The attack is network-reachable, requires no authentication to Wekan, and requires no victim interaction. An attacker registers or configures an account at any OIDC provider trusted by the target Wekan deployment, sets the email or username value to match a victim, and initiates OIDC login. Wekan silently merges the attacker's credentials into the victim account.

javascript

// Patch excerpt from packages/wekan-oidc/oidc_server.js
// Capture provider-asserted email_verified claim
serviceData.email_verified =
  userinfo["email_verified"] === true || userinfo["email_verified"] === "true";

// Patch excerpt from server/models/users.js
// Match by email only, never by username, and require opt-in + email_verified
const existingUser = await ReactiveCache.getUser({
  'emails.address': email,
});
if (!existingUser) return user;

const mergeExistingUsers =
  process.env.OAUTH2_MERGE_EXISTING_USERS === 'true' ||
  process.env.OAUTH2_MERGE_EXISTING_USERS === true;

Source: GitHub Commit 73204d4

Detection Methods for CVE-2026-52893

Indicators of Compromise

OIDC login events for existing user accounts originating from previously unseen provider sub (subject) identifiers.
Sudden changes in services.oidc metadata on established accounts, such as new id, email, or email_verified values.
Unexpected administrative actions or board access from accounts that historically authenticated via local password only.

Detection Strategies

Audit the Wekan users collection in MongoDB for accounts whose services.oidc.email_verified field is missing or false.
Compare pre-merge and post-merge account records in backups to identify silently linked OIDC identities.
Correlate OIDC provider issuance logs with Wekan login events to detect email or username collisions between distinct provider subjects.

Monitoring Recommendations

Forward Wekan application logs and reverse proxy access logs to a centralized log platform and alert on onCreateUser merge events.
Monitor the OIDC provider for account registrations using email or username values that match existing Wekan users.
Track administrator-flag changes and API token creation on accounts following an OIDC authentication event.

How to Mitigate CVE-2026-52893

Immediate Actions Required

Upgrade all Wekan instances to version 9.32 or later without delay.
Review the users collection for accounts that gained an OIDC linkage prior to the upgrade and revalidate their ownership.
Rotate API tokens and force password resets for any account suspected of unauthorized OIDC linkage.

Patch Information

The fix is shipped in Wekan 9.32 via commit 73204d4e0a7d77a1b186b3d76e8eaf2f3e7c9fd9. The patch restricts existing-user lookups to emails.address only, requires the provider to assert email_verified, and gates auto-linking behind the opt-in environment variable OAUTH2_MERGE_EXISTING_USERS, which is disabled by default. See the GitHub Security Advisory GHSA-mp7g-hj5q-gxhq and the Wekan v9.32 release notes for full remediation guidance.

Workarounds

If immediate upgrade is not possible, disable the OIDC authentication provider in the Wekan configuration until the patched release can be deployed.
Restrict the trusted OIDC provider to an identity source that enforces verified email ownership and unique usernames tied to corporate identity.
After upgrading, leave OAUTH2_MERGE_EXISTING_USERS unset so Wekan refuses to merge OIDC identities into pre-existing local accounts.

bash

# Configuration example: enforce fail-closed OIDC behavior after upgrading to 9.32
# Do NOT set OAUTH2_MERGE_EXISTING_USERS unless every trusted OIDC provider
# reliably issues email_verified=true for authenticated identities.
unset OAUTH2_MERGE_EXISTING_USERS

# Verify the running Wekan version
docker exec wekan-app cat /build/programs/server/package.json | grep version