CVE-2026-97737 - Vulnerability Details - OpenCVE

In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeover.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Muety	Wakapi

No data.

No data.

References

Link	Providers
https://github.com/muety/wakapi/commit/ce91eac2c2d9b29a00873554d2ecef76f10b9087
https://github.com/muety/wakapi/releases/tag/2.17.6
https://github.com/muety/wakapi/security/advisories/GHSA-x48w-3rq3-w2pq

History

Sat, 26 Sep 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 25 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Muety Muety wakapi
Vendors & Products		Muety Muety wakapi

Fri, 25 Sep 2026 08:30:00 +0000

Type	Values Removed	Values Added
Title		Account takeover via unintended cache context in Wakapi

Fri, 25 Sep 2026 04:30:00 +0000

Type	Values Removed	Values Added
Description		In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeover.
Weaknesses		CWE-843
References		https://github.com/muety/wakapi/commit/ce91eac2c2d9b29a00873554d2ecef76f10b9087 https://github.com/muety/wakapi/releases/tag/2.17.6 https://github.com/muety/wakapi/security/advisories/GHSA-x48w-3rq3-w2pq
Metrics		cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2026-09-25T04:08:25.094Z

Updated: 2026-09-25T15:27:35.476Z

Reserved: 2026-09-25T04:08:24.297Z

Link: CVE-2026-97737

Vulnrichment

Updated: 2026-09-25T15:27:31.898Z

NVD

Status : Deferred

Published: 2026-09-25T05:17:07.760

Modified: 2026-09-30T17:32:07.107

Link: CVE-2026-97737

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97737", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-09-25T04:08:24.297Z", "datePublished": "2026-09-25T04:08:25.094Z", "dateUpdated": "2026-09-25T15:27:35.476Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["user caching service (services/user.go)"], "packageURL": "pkg:golang/github.com/muety/wakapi", "product": "Wakapi", "programFiles": ["services/user.go"], "repo": "https://github.com/muety/wakapi", "vendor": "muety", "versions": [{"lessThan": "2.17.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "User caching enabled<br>"}], "value": "User caching enabled"}], "descriptions": [{"lang": "en", "value": "In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeover."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-843", "description": "CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-25T04:08:25.094Z"}, "references": [{"url": "https://github.com/muety/wakapi/security/advisories/GHSA-x48w-3rq3-w2pq"}, {"url": "https://github.com/muety/wakapi/releases/tag/2.17.6"}, {"url": "https://github.com/muety/wakapi/commit/ce91eac2c2d9b29a00873554d2ecef76f10b9087"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade to version 2.17.6 or later<br>"}], "value": "Upgrade to version 2.17.6 or later"}], "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Disable user caching<br>"}], "value": "Disable user caching"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-25T15:26:53.957707Z", "id": "CVE-2026-97737", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-25T15:27:35.476Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-97737", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-25T15:26:53.957707Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-25T15:27:31.898Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}], "affected": [{"repo": "https://github.com/muety/wakapi", "vendor": "muety", "modules": ["user caching service (services/user.go)"], "product": "Wakapi", "versions": [{"status": "affected", "version": "0", "lessThan": "2.17.6", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/muety/wakapi", "programFiles": ["services/user.go"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to version 2.17.6 or later", "supportingMedia": [{"type": "text/html", "value": "Upgrade to version 2.17.6 or later<br>", "base64": false}]}], "references": [{"url": "https://github.com/muety/wakapi/security/advisories/GHSA-x48w-3rq3-w2pq"}, {"url": "https://github.com/muety/wakapi/releases/tag/2.17.6"}, {"url": "https://github.com/muety/wakapi/commit/ce91eac2c2d9b29a00873554d2ecef76f10b9087"}], "workarounds": [{"lang": "en", "value": "Disable user caching", "supportingMedia": [{"type": "text/html", "value": "Disable user caching<br>", "base64": false}]}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeover."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-843", "description": "CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')"}]}], "configurations": [{"lang": "en", "value": "User caching enabled", "supportingMedia": [{"type": "text/html", "value": "User caching enabled<br>", "base64": false}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-25T04:08:25.094Z"}}}, "cveMetadata": {"cveId": "CVE-2026-97737", "state": "PUBLISHED", "dateUpdated": "2026-09-25T15:27:35.476Z", "dateReserved": "2026-09-25T04:08:24.297Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-09-25T04:08:25.094Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}