CVE-2026-123495 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja 2.0.0 before 2.7.1 accepts form-encoded requests on its /api/v2 login and OIDC callback endpoints without CSRF or Origin checks. A malicious page can make a victim's browser log in as the attacker's account, so data the victim then adds lands in the attacker's account.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host Vikunja 2.0.0 through 2.7.0 and expose its login endpoints to users. Exposure requires a user to visit an attacker-controlled page while logged in or during login; instances on a managed host that has already upgraded are not affected.
Not affected if managed-hosting, version-2.7.1-or-later
Who cares self-hosted, vikunja
2.0.0 up to but not including 2.7.1./api/v2 login or OIDC callback endpoints reachable from the internet.2.7.1 or later.Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or Origin checks, enabling login cross-site request forgery. An attacker with an account can lure a victim to a page posting the attacker's credentials or OIDC code, switching the victim into the attacker's account and exposing data the victim then adds.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.