Wekan is an open‑source kanban application built with Meteor. Prior to version 9.32, the Accounts.onCreateUser hook in server/models/users.js merges OpenID Connect (OIDC) logins into existing Wekan accounts when the OIDC email or username matches an existing user, without verifying ownership or checking email_verified. This vulnerability is an authentication bypass (CWE‑287). An attacker who uses an OIDC provider account with a victim’s email or username can cause Wekan to merge the attacker’s OIDC credentials into the victim account and then log in as that account. This issue is fixed in version 9.32.

The vulnerability affects all installations of Wekan running a version earlier than 9.32. Administrators of open‑source deployments should examine the Wekan repository or their deployed instance to determine if the server/models/users.js onCreateUser hook includes the unconditional merge logic described in the advisory.

The CVSS score of 9.2 indicates a critical impact, yet the EPSS score of less than 1% shows a low probability of exploitation at present. The issue is not listed in the CISA KEV catalog. An attacker would need access to an OIDC provider and a user account that matches the victim’s email or username to trigger the merge, suggesting the vector is indirect but feasible for attackers with control over any OIDC identity provider.