CVEvulnerability

CVE-2026-55652

9.8 CRITICAL Published 2026-07-15 Modified 2026-07-17 Official page ↗
Status
Deferred
Published
2026-07-15
Last modified
2026-07-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287, CWE-290

Description

Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED_IPS uses getRequestIp() in server/lib/headerLoginAuth.js to trust the client-supplied X-Forwarded-For header before the real socket address, allowing an unauthenticated attacker to send HEADER_LOGIN_ID for any username and receive a meteor_login_token session, including for admin. This issue is fixed in version 9.46.

Related

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-290 Authentication Bypass by Spoofing weakness

References