CVE-2026-52893: Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook
Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking emailverified. An attacker using an OIDC provider account with a victim's email or username can cause Wekan to merge the attacker's OIDC credentials into the victim account and then log in as that account. This issue is fixed in version 9.32.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wekanto a version that resolves this vulnerability.Fixed in 9.32
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52893?
CVE-2026-52893 has a critical severity rating of 9.2 on the CVSS scale.
How do I fix CVE-2026-52893?
To fix CVE-2026-52893, upgrade to Wekan version 9.32 or later where the vulnerability has been addressed.
What is the impact of CVE-2026-52893?
CVE-2026-52893 allows an attacker to perform an account takeover via unconditional email-based account merging.
Which software is affected by CVE-2026-52893?
CVE-2026-52893 affects the Wekan software prior to version 9.32.
When was CVE-2026-52893 published?
CVE-2026-52893 was published on July 15, 2026.