CVE-2025-49006

CVE-2025-49006 describes a critical vulnerability in Wasp (Web Application Specification) versions prior to 0.16.6, specifically impacting its OAuth authentication implementation when used with Keycloak configured for case-sensitive user IDs. The flaw stems from Wasp inappropriately lowercasing OAuth user IDs, violating specifications and leading to potential user impersonation, account collisions, and privilege escalation. With a CVSS score of 8.2 (High), this vulnerability has a network attack vector and low attack complexity, allowing unauthenticated attackers to potentially compromise user accounts. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.