Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-75774: OAuth skips the email-verification check the password path enforces. https://t.co/qmeAXubbf7
Post summary
The tweet announces CVE-2026-75774, describing an OAuth bypass where email verification is skipped on the password path, and includes a link for further details.
ZAST found two CVEs in Karakeep ≤ 0.32.0: CVE-2026-75773 (login brute-force, CVSS 3.1 = 5.3) and CVE-2026-75774 (OAuth email-verification bypass, CVSS 3.1 = 4.8). 75773: no rate limiting on the credential login path. https://t.co/FuHWwx9b2R
Post summary
The tweet announces two newly found CVEs in Karakeep and provides vulnerability types, CVSS scores, and one technical detail about missing rate limiting. It does not clearly indicate a PoC, exploit tool, active exploitation, or patch.