{"id":"CVE-2026-52893","title":"Wekan is open source kanban built with Meteor","summary":"Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, withou…","severity":"none","cwe":["CWE-287"],"published":"2026-07-15","updated":"2026-07-18","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-52893","references":[{"url":"https://github.com/wekan/wekan/commit/73204d4e0a7d77a1b186b3d76e8eaf2f3e7c9fd9","label":"security-advisories@github.com"},{"url":"https://github.com/wekan/wekan/releases/tag/v9.32","label":"security-advisories@github.com"},{"url":"https://github.com/wekan/wekan/security/advisories/GHSA-mp7g-hj5q-gxhq","label":"security-advisories@github.com"},{"url":"https://github.com/wekan/wekan/security/advisories/GHSA-mp7g-hj5q-gxhq","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.0048,"epssPercentile":0.40567,"ingestedAt":"2026-07-18T18:24:14.353Z","slug":"CVE-2026-52893","body":"## Overview\n\nWekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking email_verified. An attacker using an OIDC provider account with a victim's email or username can cause Wekan to merge the attacker's OIDC credentials into the victim account and then log in as that account. This issue is fixed in version 9.32.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}