OCTOBER 9, 2026
Live Feed
Back to database
Case File

CVE-2026-97737

HIGH · CVSS 7.4 EPSS 0.27% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-25 · Last synced 2026-10-09

CyberRota Analysis

AI-Generated

The user caching service in Wakapi versions prior to 2.17.6 is vulnerable to an unintended lookup context, which could allow attackers to perform account takeover. Organizations using affected versions should prioritize patching this vulnerability to mitigate the risk of unauthorized access to user accounts. Immediate action is recommended for any deployments of Wakapi to ensure security against potential exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-97737
Severity
HIGH
CVSS
7.4
EPSS
0.27%

Original NVD Description

In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeover.