The vulnerability resides in the user caching service of Wakapi prior to version 2.17.6. An unintended lookup context allows a lookup request to be resolved against the wrong user, which can lead to an attacker hijacking another user's account. This type of flaw corresponds to improper type conversion errors (CWE‑843) and enables an attacker to gain unauthorized access and control over user accounts.

The affected systems are installations of the Wakapi application before version 2.17.6. Specific vendors are muety:Wakapi. Any user host running the vulnerable version is at risk until the patch is applied or mitigation is enacted.

The risk is high with a CVSS score of 7.4. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalogue. The likely attack vector is through the public caching mechanism; any user who can trigger a cache lookup can exploit the flaw to take over another account. Exploitation requires no special conditions beyond accessing the caching endpoint, making it relatively straightforward for an attacker with network reach to the Wakapi service.