CVE-2026-97737

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-97737

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97737.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-97737

Aliases

GHSA-x48w-3rq3-w2pq

Published

2026-09-25T04:08:25Z

Modified

2026-10-21T03:00:24Z

Severity

7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

[none]

Details

In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeover.

Database specific

{
    "cna_assigner":  "mitre",
    "cwe_ids":  [
        "CWE-843"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97737.json"
}

References

Affected packages

Git / github.com/muety/wakapi

Affected ranges

Type

GIT

Repo

https://github.com/muety/wakapi

Events

Introduced

Fixed

ce91eac2c2d9b29a00873554d2ecef76f10b9087

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.17.6"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "original_tag":  "2.17.6",
            "range":  [
                {
                    "fixed":  "ce91eac2c2d9b29a00873554d2ecef76f10b9087"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "range":  [
                {
                    "fixed":  "ce91eac2c2d9b29a00873554d2ecef76f10b9087"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.17.6"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

0.*

0.2.6

1.*

1.0.0

1.1.0

1.12.2

1.12.5

1.14.0

1.14.1

1.15.1

1.16.0

1.16.1

1.16.2

1.17.2

1.17.3

1.18.0

1.18.2

1.19.0

1.2.2

1.20.0

1.20.1

1.20.2

1.21.0

1.22.0

1.22.1

1.22.2

1.23.2

1.23.3

1.23.5

1.23.6

1.24.0

1.24.1

1.24.3

1.24.4

1.24.5

1.25.4

1.26.1

1.26.4

1.26.5

1.26.7

1.26.8

1.27.0

1.27.2

1.27.3

1.28.0

1.28.1

1.28.2

1.28.3

1.29.0

1.29.1

1.29.3

1.29.4

1.29.5

1.29.6

1.30.0

1.30.1

1.30.2

1.30.3

1.5.1

1.5.5

1.6.2

1.6.3

1.7.1

1.7.4

1.7.6

2.*

2.0.0-RC1

2.0.1

2.10.0

2.10.1

2.10.2

2.10.3

2.10.4

2.10.5

2.11.2

2.12.0

2.12.2

2.12.3

2.13.0

2.13.1

2.13.2

2.13.3

2.13.4

2.14.0

2.14.1

2.15.0

2.16.0

2.16.1

2.17.0

2.17.1

2.17.2

2.17.3

2.17.4

2.17.5

2.2.0

2.2.2

2.2.3

2.2.4

2.2.5

2.3.0

2.3.1

2.3.2

2.3.5

2.3.6

2.3.7

2.3.8

2.4.0

2.5.0

2.5.1

2.5.2

2.5.3

2.5.4

2.6.0

2.6.1

2.6.2

2.7.0

2.8.0

2.8.1

2.8.2

2.9.0

2.9.1

2.9.2

2.9.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97737.json"