CVE-2026-75774

karakeep-app karakeep OAuth Sign-In auth.ts improper authentication

Published Aug 18, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

karakeep-app

karakeep

affected

Version	Status	Constraints
`0.1`	affected	—
`0.2`	affected	—
`0.3`	affected	—
`0.4`	affected	—
`0.5`	affected	—
`0.6`	affected	—
`0.7`	affected	—
`0.8`	affected	—
`0.9`	affected	—
`0.10`	affected	—
`0.11`	affected	—
`0.12`	affected	—
`0.13`	affected	—
`0.14`	affected	—
`0.15`	affected	—
`0.16`	affected	—
`0.17`	affected	—
`0.18`	affected	—
`0.19`	affected	—
`0.20`	affected	—
`0.21`	affected	—
`0.22`	affected	—
`0.23`	affected	—
`0.24`	affected	—
`0.25`	affected	—
`0.26`	affected	—
`0.27`	affected	—
`0.28`	affected	—
`0.29`	affected	—
`0.30`	affected	—
`0.31`	affected	—
`0.32.0`	affected	—

No data.

Vendor Product Versions

Karakeep-app

Karakeep

Version	Status	Scheme	Platform
`0.1`	affected	generic	—
`0.2`	affected	generic	—
`0.3`	affected	generic	—
`0.4`	affected	generic	—
`0.5`	affected	generic	—
`0.6`	affected	generic	—
`0.7`	affected	generic	—
`0.8`	affected	generic	—
`0.9`	affected	generic	—
`0.10`	affected	generic	—
`0.11`	affected	generic	—
`0.12`	affected	generic	—
`0.13`	affected	generic	—
`0.14`	affected	generic	—
`0.15`	affected	generic	—
`0.16`	affected	generic	—
`0.17`	affected	generic	—
`0.18`	affected	generic	—
`0.19`	affected	generic	—
`0.20`	affected	generic	—
`0.21`	affected	generic	—
`0.22`	affected	generic	—
`0.23`	affected	generic	—
`0.24`	affected	generic	—
`0.25`	affected	generic	—
`0.26`	affected	generic	—
`0.27`	affected	generic	—
`0.28`	affected	generic	—
`0.29`	affected	generic	—
`0.30`	affected	generic	—
`0.31`	affected	generic	—
`0.32.0`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity High

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.579% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/karakeep-app/karakeep/
https://github.com/karakeep-app/karakeep/issues/2920
https://vuldb.com/cve/CVE-2026-75774
https://vuldb.com/submit/877732
https://vuldb.com/vuln/391520
https://vuldb.com/vuln/391520/cti

History

Aug 18, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 18, 2026 11:30 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Title		karakeep-app karakeep OAuth Sign-In auth.ts improper authentication
First Time appeared		Karakeep-app Karakeep-app karakeep
Weaknesses		CWE-287
CPEs		cpe:2.3:a:karakeep-app:karakeep::::::::
Vendors & Products		Karakeep-app Karakeep-app karakeep
References		https://github.com/karakeep-app/karakeep/ https://github.com/karakeep-app/karakeep/issues/2920 https://vuldb.com/cve/CVE-2026-75774 https://vuldb.com/submit/877732 https://vuldb.com/vuln/391520 https://vuldb.com/vuln/391520/cti
Metrics		cvssV2_0 `{'score': 2.6, 'vector': 'AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C'}` cvssV3_0 `{'score': 3.7, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}`