CVE-2026-55652 Details

A vulnerability in Wekan's header-login feature prior to version 9.46 allows an unauthenticated attacker to bypass the IP allowlist and gain full access to any user account, including admin. The issue arises because the allowlist check relies on the client-controlled X-Forwarded-For header, which can be easily spoofed. Attackers who can reach the Wekan HTTP port directly can exploit this flaw by sending a request that appears to come from a trusted IP, along with a username header. This manipulation tricks the application into issuing a valid login token for the specified user, effectively enabling account takeover.

Users must update to Wekan version 9.46 or later. After updating, it is crucial to set the 'HEADER_LOGIN_TRUSTED_IPS' environment variable to the IP address(es) of the reverse proxy. For deployments behind multiple proxy hops, 'HEADER_LOGIN_TRUSTED_PROXIES' can be used to specify intermediate proxy IPs.