---
id: CVE-2026-52893
title: Wekan is open source kanban built with Meteor
summary: >-
  Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan
  Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into
  existing accounts when the OIDC email or username matches an existing Wekan
  user, withou…
severity: none
cwe:
  - CWE-287
published: '2026-07-15'
updated: '2026-07-18'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-52893'
references:
  - url: >-
      https://github.com/wekan/wekan/commit/73204d4e0a7d77a1b186b3d76e8eaf2f3e7c9fd9
    label: security-advisories@github.com
  - url: 'https://github.com/wekan/wekan/releases/tag/v9.32'
    label: security-advisories@github.com
  - url: 'https://github.com/wekan/wekan/security/advisories/GHSA-mp7g-hj5q-gxhq'
    label: security-advisories@github.com
  - url: 'https://github.com/wekan/wekan/security/advisories/GHSA-mp7g-hj5q-gxhq'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.0048
epssPercentile: 0.40579
ingestedAt: '2026-07-18T18:24:14.353Z'
---

## Overview

Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking email_verified. An attacker using an OIDC provider account with a victim's email or username can cause Wekan to merge the attacker's OIDC credentials into the victim account and then log in as that account. This issue is fixed in version 9.32.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.