CVE-2026-75773: karakeep Authentication Bypass Vulnerability

CVE-2026-75773 Overview

CVE-2026-75773 affects karakeep-app karakeep through version 0.32.0. The vulnerability resides in the authorize function of apps/web/server/auth.ts within the Login Endpoint component. The flaw allows improper restriction of excessive authentication attempts [CWE-307], enabling remote brute-force attempts against user credentials. The issue is patched in version 0.33.0 via commit f7d042971d0d2bcc7119654830cf1eb93eabbf24, which introduces rate limiting on password login attempts. A public exploit description exists, though exploitation is characterized as high complexity.

Critical Impact
Remote attackers can perform unrestricted authentication attempts against the Karakeep login endpoint, facilitating credential-guessing attacks.

Affected Products

karakeep-app karakeep versions up to and including 0.32.0
Component: Login Endpoint (apps/web/server/auth.ts)
Fixed in: karakeep 0.33.0

Discovery Timeline

2026-08-18 - CVE-2026-75773 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75773

Vulnerability Analysis

The vulnerability is classified under CWE-307: Improper Restriction of Excessive Authentication Attempts. The authorize function inside apps/web/server/auth.ts handled password-based credential validation without enforcing a request-rate limit. An unauthenticated remote actor can submit repeated login attempts against valid usernames. The absence of throttling permits automated credential guessing, password spraying, and dictionary attacks. Successful exploitation depends on weak or reused passwords, which is why the reported exploitability is described as difficult.

Root Cause

The pre-patch authorize implementation did not track authentication attempts per source IP address or account. NextAuth's CredentialsProvider accepted every incoming submission without correlating prior failures. This omission is documented in GitHub Issue #2919 and resolved by integrating client IP identification through the request-ip module.

Attack Vector

Exploitation occurs over the network by repeatedly posting credentials to the Karakeep authentication endpoint. Attackers can script large-volume submissions from a single host or distribute requests across proxies. No user interaction or prior authentication is required. Attack complexity remains high because success requires guessing valid credentials rather than a deterministic exploit primitive.

typescript

// Security patch in apps/web/server/auth.ts
// fix: ratelimit password login attempts
 import { Adapter as NextAuthAdapater } from "next-auth/adapters";
 import CredentialsProvider from "next-auth/providers/credentials";
 import { Provider } from "next-auth/providers/index";
+import requestIp from "request-ip";
 
 import { db } from "@karakeep/db";
 import {

Source: GitHub Commit f7d0429. The patch introduces request-ip to identify the caller and gate authentication attempts against a per-source rate limit.

Detection Methods for CVE-2026-75773

Indicators of Compromise

Repeated POST requests to the Karakeep login endpoint from a single source IP within a short window.
Elevated volumes of failed authentication events in Karakeep application logs.
Login attempts distributed across many usernames from the same origin, indicating password spraying.

Detection Strategies

Baseline normal login-attempt frequency per user and per source IP, then alert on statistical outliers.
Correlate authentication failures with subsequent successful logins to identify potential credential compromise.
Deploy web application firewall (WAF) rules that count failed /api/auth responses per client and trigger on threshold breaches.

Monitoring Recommendations

Forward Karakeep application and reverse-proxy access logs to a centralized SIEM for retention and correlation.
Track HTTP 401 and 403 response rates against the login route and alert on sustained spikes.
Monitor for user-agent strings and IP ranges associated with credential-stuffing tooling.

How to Mitigate CVE-2026-75773

Immediate Actions Required

Upgrade Karakeep to version 0.33.0 or later, which includes the rate-limiting fix in commit f7d042971d0d2bcc7119654830cf1eb93eabbf24.
Enforce strong password policies and enable multi-factor authentication where supported to reduce the impact of guessing attacks.
Rotate credentials for any accounts that appear in high-volume login-failure events prior to patching.

Patch Information

The fix is available in Karakeep Release v0.33.0. The patch commit f7d042971d0d2bcc7119654830cf1eb93eabbf24 adds the request-ip dependency and implements per-source rate limiting on the credentials authorize function. Additional context is available in VulDB CVE-2026-75773.

Workarounds

Place Karakeep behind a reverse proxy such as Nginx, Traefik, or Cloudflare and configure rate limiting on the authentication path.
Restrict access to the Karakeep login endpoint using IP allowlists or a VPN when public exposure is not required.
Deploy a WAF policy that throttles or blocks clients exceeding a defined threshold of failed authentication attempts.

bash

# Example Nginx rate limit for the Karakeep auth endpoint
limit_req_zone $binary_remote_addr zone=karakeep_login:10m rate=5r/m;

server {
    location /api/auth/ {
        limit_req zone=karakeep_login burst=5 nodelay;
        proxy_pass http://karakeep_backend;
    }
}