GHSA-8phm-9rqm-v9hc was reported by binary-lover.
WeKan mirrored Meteor's persistent resume token into a cookie from browser JavaScript for authenticated file requests. Such a cookie cannot use the HttpOnly attribute, and Meteor also retained the token in Local Storage, leaving persistent credentials readable to scripts running in the WeKan origin.
Fix: WeKan enables Meteor 3.5's native HttpOnly resume-cookie flow on client and server, disables persistent Web Storage credentials and removes the custom readable cookie synchronization. Header-login cookies also receive HttpOnly alongside SameSite and HTTPS Secure attributes. Fixed for the upcoming WeKan release on 2026-08-29.