{"id":"CVE-2026-97737","aliases":["EUVD-2026-86516","GHSA-9786-jc2r-f539","GHSA-x48w-3rq3-w2pq"],"status":"published","title":"In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended...","description":"In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeover.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00266,"percentile":0.18926,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-843"],"published":"2026-09-25T04:08:25Z","modified":"2026-10-28T02:30:51Z","products":[{"vendor":"muety","product":"wakapi"}],"references":[{"url":"https://github.com/muety/wakapi/security/advisories/GHSA-x48w-3rq3-w2pq","tags":["advisory"]},{"url":"https://github.com/muety/wakapi/releases/tag/2.17.6","tags":["web"]},{"url":"https://github.com/muety/wakapi/commit/ce91eac2c2d9b29a00873554d2ecef76f10b9087","tags":["fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97737","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9786-jc2r-f539"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97737.json","tags":["advisory"]},{"url":"https://github.com/muety/wakapi","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-97737","description":"In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeover.","status":"published","published":"2026-09-25T04:08:25.094Z","modified":"2026-09-25T15:27:35.476Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T13:44:18.366073Z"}],"euvd":[{"id":"EUVD-2026-86516","description":"In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeover.","status":"published","published":"2026-09-25T04:08:25Z","modified":"2026-09-25T15:27:35Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T17:27:55.413842Z"}],"ghsa":[{"id":"GHSA-9786-jc2r-f539","title":"In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended...","description":"In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeover.","status":"published","published":"2026-09-25T06:30:32Z","modified":"2026-09-25T06:31:30Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T15:12:24.174061Z"}],"nvd":[{"id":"CVE-2026-97737","description":"In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeover.","status":"published","published":"2026-09-25T05:17:07.76Z","modified":"2026-09-30T17:32:07.107Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:12:51.388161Z"}],"osv":[{"id":"CVE-2026-97737","description":"In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeover.","status":"published","published":"2026-09-25T04:08:25.094Z","modified":"2026-10-28T02:30:51.726175433Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T15:45:21.262447Z"}]}}