CVE-2026-55652: Wekan: Unauthenticated Account Takeover via Spoofed IP Address

Summary

An attacker can gain full access to any Wekan account, including admin accounts, by sending a fake IP address. This can happen if you're using Wekan's header-login feature with trusted IP addresses. To fix this, update to Wekan version 9.46 or later.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions
wekan	wekan	< 9.46

Original title

Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED_IPS uses getRequestIp() in server/lib/headerLoginAuth.js to trust the client-supplied X-Forwarde...

Original description

Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED_IPS uses getRequestIp() in server/lib/headerLoginAuth.js to trust the client-supplied X-Forwarded-For header before the real socket address, allowing an unauthenticated attacker to send HEADER_LOGIN_ID for any username and receive a meteor_login_token session, including for admin. This issue is fixed in version 9.46.

mitre CVSS3.1 9.8

Vulnerability type

CWE-287 Improper Authentication

CWE-290

https://github.com/wekan/wekan/security/advisories/GHSA-jggc-qvfc-jr6x x_refsource_CONFIRM
https://github.com/wekan/wekan/commit/b181889a565254bc9bf79379a34fc7f617ccda28 x_refsource_MISC
https://github.com/wekan/wekan/releases/tag/v9.46 x_refsource_MISC