CyberRota Analysis
AI-GeneratedWekan versions prior to 9.46 are vulnerable due to improper validation of the X-Forwarded-For header, allowing unauthenticated attackers to exploit this weakness and obtain a meteor_login_token for any user, including administrators. This critical vulnerability poses a significant risk to any organization using Wekan, as it enables unauthorized access to sensitive data and administrative functions. Organizations running affected versions should prioritize immediate updates to version 9.46 or later to mitigate this security threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED_IPS uses getRequestIp() in server/lib/headerLoginAuth.js to trust the client-supplied X-Forwarded-For header before the real socket address, allowing an unauthenticated attacker to send HEADER_LOGIN_ID for any username and receive a meteor_login_token session, including for admin. This issue is fixed in version 9.46.