CVE-2026-55652CWE-287CWE-290

Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)

Critical · published July 15, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
49.0
In the wild
Unconfirmed
What it is

Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED_IPS uses getRequestIp() in server/lib/headerLoginAuth.js to trust the client-supplied X-Forwarded-For header before the real socket address, allowing an unauthenticated attacker to send HEADER_LOGIN_ID for any username and receive a meteor_login_token session, including for admin. This issue is fixed in version 9.46.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00620 · 49.0th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-290 · Authentication Bypass by Spoofing
Published
2026-07-15T21:15Z
EPSS history
Timeline
  • 15 JUL 21:15Z
    Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)
    cvelistv5