CVE-2026-75774 Overview
CVE-2026-75774 is an improper authentication vulnerability [CWE-287] in the karakeep-app karakeep bookmark management application through version 0.32.0. The flaw resides in an unknown function within apps/web/server/auth.ts and affects the OAuth Sign-In component. An attacker can trigger the weakness remotely over the network without authentication or user interaction. Exploitation is rated as high complexity, meaning specific preconditions must be met for the attack to succeed. The exploit technique has been publicly disclosed. The maintainers received an early issue report but have not yet responded at the time of disclosure.
Critical Impact
Successful exploitation impacts integrity of the authentication flow, potentially allowing an attacker to bypass expected OAuth identity assertions in Karakeep deployments.
Affected Products
- karakeep-app karakeep versions up to and including 0.32.0
- Affected component: OAuth Sign-In flow in apps/web/server/auth.ts
- Self-hosted Karakeep instances exposing the web authentication endpoint
Discovery Timeline
- 2026-08-18 - CVE-2026-75774 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-75774
Vulnerability Analysis
The vulnerability is classified under CWE-287: Improper Authentication. The defect lives in Karakeep's server-side authentication handler at apps/web/server/auth.ts, which orchestrates the OAuth Sign-In workflow. Improper validation within this handler allows an unauthenticated remote attacker to interfere with the identity assertion produced by the OAuth flow. The impact is limited to integrity of the authentication decision; the reference scoring indicates no direct confidentiality or availability consequences from the flaw itself. Downstream effects depend on how the authenticated principal is trusted by the remainder of the application. Because Karakeep is a self-hosted bookmark and knowledge management platform, exploitation could permit an attacker to influence account association during sign-in.
Root Cause
The root cause is improper authentication logic in the OAuth Sign-In implementation in apps/web/server/auth.ts. The handler does not correctly validate one or more properties of the OAuth response before establishing the authenticated session. Public references from VulDB and the upstream GitHub issue tracker describe the class of defect but the maintainers have not yet acknowledged the report.
Attack Vector
The attack is remote and network-based. It targets the public OAuth Sign-In endpoint of a Karakeep deployment and does not require prior authentication or user interaction. The advisory notes the attack complexity is high, indicating that the attacker must satisfy non-trivial conditions during the OAuth exchange to successfully bypass the identity check.
No verified public exploit code is included with this advisory. The vulnerability mechanism is documented in the GitHub Issue #2920 and the VulDB CVE-2026-75774 entry.
Detection Methods for CVE-2026-75774
Indicators of Compromise
- Successful OAuth Sign-In events in Karakeep logs that lack a corresponding, verifiable identity provider callback
- Session establishment events for accounts that do not match the OAuth provider's canonical user identifier
- Unexpected linkage of local Karakeep accounts to external OAuth identities that users did not initiate
Detection Strategies
- Review web server access logs for repeated or anomalous requests to the Karakeep /auth and OAuth callback routes
- Correlate Karakeep authentication events with identity provider logs to detect sessions created without a matching provider assertion
- Alert on newly created or modified user records in the Karakeep database that occur outside expected sign-up flows
Monitoring Recommendations
- Enable verbose logging on the Karakeep authentication handler and forward events to a centralized log platform
- Monitor for spikes in failed or malformed OAuth callback requests, which may indicate exploitation attempts
- Track administrative and privileged account activity in Karakeep for signs of unauthorized access
How to Mitigate CVE-2026-75774
Immediate Actions Required
- Restrict network exposure of Karakeep instances to trusted networks or place the application behind an authenticating reverse proxy
- Audit all existing user accounts for unexpected OAuth identity bindings and revoke unfamiliar sessions
- Rotate OAuth client secrets and provider credentials if unauthorized sign-in activity is suspected
Patch Information
At the time of publication, the karakeep-app project has not released a fixed version or responded to the upstream report. Track the Karakeep GitHub repository and Issue #2920 for a vendor patch, and upgrade to a version later than 0.32.0 once a fix is published.
Workarounds
- Disable the OAuth Sign-In provider in Karakeep configuration and fall back to a stronger local authentication method until a patch is available
- Place Karakeep behind a reverse proxy or identity-aware gateway that performs its own authentication before requests reach apps/web/server/auth.ts
- Enforce IP allowlisting on the Karakeep web interface to limit exposure of the vulnerable endpoint
- Require multi-factor authentication at the upstream identity provider to reduce the value of a bypassed OAuth assertion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
