Low
karakeep-app karakeep OAuth Sign-In auth.ts improper authentication
Type: advisorySources: OSV
A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-75774
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 8 Nov 2026, 00:21 UTC · Revision 1
Source evidence
karakeep-app karakeep OAuth Sign-In auth.ts improper authentication
core-osv · Original sourcePublished 18 Aug 2026, 11:15 UTC
A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
osv:CVE-2026-75774
Complete source record
{
"id": "99212435906223eb3f4d7412c945f16a4961edd4c17a874ef06ebab2cd9f5574",
"url": "https://osv.dev/vulnerability/CVE-2026-75774",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "karakeep-app karakeep OAuth Sign-In auth.ts improper authentication",
"summary": "A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.",
"evidence": "osv:CVE-2026-75774",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2026-75774",
"aliases": [
"CVE-2026-75774"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/karakeep-app/karakeep",
"type": "GIT",
"events": [
{
"introduced": "8f01767be35850f5400828283caff44074f6a458"
},
{
"last_affected": "b9b252ecb6d2af379192778ec24f766d4cd60da3"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0.1"
},
{
"last_affected": "0.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.2"
},
{
"last_affected": "0.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.3"
},
{
"last_affected": "0.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.4"
},
{
"last_affected": "0.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.5"
},
{
"last_affected": "0.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.6"
},
{
"last_affected": "0.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.7"
},
{
"last_affected": "0.7"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.8"
},
{
"last_affected": "0.8"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.9"
},
{
"last_affected": "0.9"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.10"
},
{
"last_affected": "0.10"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.11"
},
{
"last_affected": "0.11"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.12"
},
{
"last_affected": "0.12"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.13"
},
{
"last_affected": "0.13"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.14"
},
{
"last_affected": "0.14"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.15"
},
{
"last_affected": "0.15"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.16"
},
{
"last_affected": "0.16"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.17"
},
{
"last_affected": "0.17"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.18"
},
{
"last_affected": "0.18"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.19"
},
{
"last_affected": "0.19"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.20"
},
{
"last_affected": "0.20"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.21"
},
{
"last_affected": "0.21"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.22"
},
{
"last_affected": "0.22"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.23"
},
{
"last_affected": "0.23"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.24"
},
{
"last_affected": "0.24"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.25"
},
{
"last_affected": "0.25"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.26"
},
{
"last_affected": "0.26"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.27"
},
{
"last_affected": "0.27"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.28"
},
{
"last_affected": "0.28"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.29"
},
{
"last_affected": "0.29"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.30"
},
{
"last_affected": "0.30"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.31"
},
{
"last_affected": "0.31"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0.32.0"
},
{
"last_affected": "0.32.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
},
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "0.32.0"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"0.1",
"0.10",
"0.11",
"0.12",
"0.13",
"0.14",
"0.15",
"0.16",
"0.17",
"0.18",
"0.19",
"0.2",
"0.20",
"0.21",
"0.22",
"0.23",
"0.24",
"0.25",
"0.26",
"0.27",
"0.28",
"0.29",
"0.3",
"0.30",
"0.31",
"0.32.0",
"0.4",
"0.5",
"0.6",
"0.7",
"0.8",
"0.9"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75774.json"
}
}
],
"modified": "2026-10-28T02:30:52.035158005Z",
"provider": "osv",
"references": [
"https://github.com/karakeep-app/karakeep/",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75774.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-75774",
"https://vuldb.com/cve/CVE-2026-75774",
"https://vuldb.com/submit/877732",
"https://vuldb.com/vuln/391520",
"https://github.com/karakeep-app/karakeep/issues/2920",
"https://vuldb.com/vuln/391520/cti"
],
"provider_metadata": {
"cwe_ids": [
"CWE-287"
],
"cna_assigner": "VulDB",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75774.json"
}
},
"related_cves": [
{
"value": "CVE-2026-75774",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 520926,
"published_at": "2026-08-18T11:15:09.946+00:00"
}