CyberRota Analysis
AI-GeneratedWekan versions prior to 9.32 are vulnerable due to a flaw in the Accounts.onCreateUser hook, which allows an attacker to merge their OpenID Connect (OIDC) credentials with an existing user account if they possess the same email or username, without proper verification. This vulnerability can lead to unauthorized access to user accounts, potentially compromising sensitive information and user data. Organizations using Wekan should prioritize updating to version 9.32 to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking email_verified. An attacker using an OIDC provider account with a victim's email or username can cause Wekan to merge the attacker's OIDC credentials into the victim account and then log in as that account. This issue is fixed in version 9.32.