CVE-2026-52893

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.32

Description The Accounts.onCreateUser function in server/models/users.js merges OIDC logins into existing accounts when the OIDC email or username matches an existing user without verifying ownership or checking the email verified status. An attacker can use an OIDC provider account with a victim's email or username to merge their credentials into the victim's account and gain unauthorized access.

Recommendations Update to version 9.32.