CVE-2026-75774: karakeep-app karakeep OAuth Sign-In auth.ts improper authentication
A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Karakeep deployments using the OAuth Sign-In component are the relevant exposure area, with affected versions reported up to 0.32.0. The issue is in apps/web/server/auth.ts, although the specific vulnerable function is not identified.
What does an attacker need to exploit this issue?
The attack can be initiated remotely and does not require privileges or user interaction, but it has high attack complexity and is regarded as difficult to exploit. Public exploit disclosure means attempts may be feasible despite the complexity.
Is a default installation affected, and what can be done while remediation is pending?
The available information does not state whether OAuth Sign-In is enabled by default or provide a mitigation other than addressing the affected software. If immediate remediation is not possible, prioritize review of externally reachable OAuth Sign-In exposure.