CVE-2026-55652 - Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)

Back Back to CVE browser

CRITICAL

Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)

Published Jul 15, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 0.62%

Description

Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED_IPS uses getRequestIp() in server/lib/headerLoginAuth.js to trust the client-supplied X-Forwarded-For header before the real socket address, allowing an unauthenticated attacker to send HEADER_LOGIN_ID for any username and receive a meteor_login_token session, including for admin. This issue is fixed in version 9.46.

Affected products

Vendor Wekan Product Wekan Default
n/a
- Version
  < 9.46
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Wekan

n/a

Version	Status	Constraints
< 9.46	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-287

Improper Authentication

CWE-290

Authentication Bypass by Spoofing

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44817
Advisory
https://github.com/wekan/wekan/commit/b181889a565254bc9bf79379a34fc7f617ccda28
x_refsource_MISC
https://github.com/wekan/wekan/releases/tag/v9.46
x_refsource_MISC
https://github.com/wekan/wekan/security/advisories/GHSA-jggc-qvfc-jr6x
exploitx_refsource_CONFIRM

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44817		Advisory
https://github.com/wekan/wekan/commit/b181889a565254bc9bf79379a34fc7f617ccda28		x_refsource_MISC
https://github.com/wekan/wekan/releases/tag/v9.46		x_refsource_MISC
https://github.com/wekan/wekan/security/advisories/GHSA-jggc-qvfc-jr6x		exploitx_refsource_CONFIRM