Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing Wekan user, without verifying ownership or checking email_verified. An attacker using an OIDC provider account with a victim's email or username can cause Wekan to merge the attacker's OIDC credentials into the victim account and then log in as that account. This issue is fixed in version 9.32.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-52893 Account Takeover via OIDC Credential Merge in Wekan Prior to 9.32 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-52893
Post summary
A new CVE (CVE-2026-52893) has been disclosed for Wekan versions prior to 9.32, detailing an account takeover path via OIDC credential merge, with no exploit or patch information provided.