CVE-2026-75774
LowCVSS 3.7Summary
A vulnerability in karakeep-app karakeep up to 0.32.0 affects an unknown function in apps/web/server/auth.ts of the OAuth Sign-In component. Manipulation causes improper authentication. The attack can be initiated remotely but is difficult to exploit. The exploit has been publicly disclosed.
Risk Assessment
Improper authentication may allow unauthorized access to user accounts, potentially leading to data confidentiality breaches.
Recommendation
Monitor the project for patches and consider temporary mitigations to restrict access to OAuth Sign-In.
Original NVD description (English source)
A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.