Hall of Fame image from https://openclipart.org/detail/120343/trophy
Back to Hall of Fame Contents Back to Wekan Website

Contents / CasBleed

CVE Vulnerability name Date Responsible Security Disclosure by Vulnerabilities
-

CasBleed

2026-07-19 meifukun (GitHub) and xet7 (fix)

Privately reported 8 issues reviewed against WeKan v9.95.0.
  • CasBleed — with CAS login enabled, packages/wekan-accounts-cas/cas_server.js stored validated CAS user data in a single module-global _userData shared across concurrent logins. Two logins racing could bind an attacker's credential token to a victim's user data, issuing the attacker a session for the victim's account (full admin if the victim was an admin). Fixed by binding the validated CAS user data PER credential token (CWE-362 Race Condition → Account Takeover)
  • Reported privately by meifukun (https://github.com/meifukun)
  • Fixed at upcoming WeKan release
  • More details


Details

CasBleed — CWE-362 Race Condition → Account Takeover

with CAS login enabled, packages/wekan-accounts-cas/cas_server.js stored validated CAS user data in a single module-global _userData shared across concurrent logins. Two logins racing could bind an attacker's credential token to a victim's user data, issuing the attacker a session for the victim's account (full admin if the victim was an admin). Fixed by binding the validated CAS user data PER credential token.

Reported privately by meifukun (https://github.com/meifukun), who reviewed 8 issues against WeKan v9.95.0 (commit f602b9459fa1622f60ee8c3b639f02035f3ab32b) on local self-hosted instances only. Fixed at the upcoming WeKan release.