Hall of Fame image from https://openclipart.org/detail/120343/trophy
Back to Hall of Fame Contents Back to Wekan Website

Contents / InviteBleed

CVE Vulnerability name Date Responsible Security Disclosure by Vulnerabilities
-

InviteBleed

2026-07-19 meifukun (GitHub) and xet7 (fix)

Privately reported 8 issues reviewed against WeKan v9.95.0.
  • InviteBleed — when public registration is disabled, invitation registration used a 6-digit code generated with Math.random() (~900,000 keyspace, non-cryptographic RNG; server/models/settings.js) with no throttling on the sign-up validation, so an attacker who knew a pending invitee's email could brute-force the code, claim the account and join its private boards. Fixed by generating a 128-bit crypto.randomBytes invitation code and rate-limiting createUser with DDPRateLimiter (CWE-330 Insufficiently Random Values + CWE-307 Excessive Auth Attempts)
  • Reported privately by meifukun (https://github.com/meifukun)
  • Fixed at upcoming WeKan release
  • More details


Details

InviteBleed — CWE-330 Insufficiently Random Values + CWE-307 Excessive Auth Attempts

when public registration is disabled, invitation registration used a 6-digit code generated with Math.random() (~900,000 keyspace, non-cryptographic RNG; server/models/settings.js) with no throttling on the sign-up validation, so an attacker who knew a pending invitee's email could brute-force the code, claim the account and join its private boards. Fixed by generating a 128-bit crypto.randomBytes invitation code and rate-limiting createUser with DDPRateLimiter.

Reported privately by meifukun (https://github.com/meifukun), who reviewed 8 issues against WeKan v9.95.0 (commit f602b9459fa1622f60ee8c3b639f02035f3ab32b) on local self-hosted instances only. Fixed at the upcoming WeKan release.