{"id":"CVE-2026-123495","kind":"vulnerability","aliases":["CVE-2026-123495"],"related":[],"title":"Vikunja: login endpoints accept cross-site form posts, enabling login CSRF","description":"Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or Origin checks, enabling login cross-site request forgery. An attacker with an account can lure a victim to a page posting the attacker's credentials or OIDC code, switching the victim into the attacker's account and exposing data the victim then adds.","summary":"Vikunja 2.0.0 before 2.7.1 accepts form-encoded requests on its /api/v2 login and OIDC callback endpoints without CSRF or Origin checks. A malicious page can make a victim's browser log in as the attacker's account, so data the victim then adds lands in the attacker's account.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","vikunja"],"not_affected_if":["managed-hosting","version-2.7.1-or-later"],"how_to_check":"- Check the installed Vikunja version; affected range is `2.0.0` up to but not including `2.7.1`.\n- Look for a Vikunja instance on `/api/v2` login or OIDC callback endpoints reachable from the internet.","fix":"- Vikunja: move to `2.7.1` or later.","status":"open","published_at":"2026-11-08T02:16:36+00:00","first_seen_at":"2026-11-08T02:21:07+00:00","triaged_at":"2026-11-08T02:25:28+00:00","updated_at":"2026-11-08T02:25:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:25:28Z","model":"claude-haiku-5-5","output":{"fix":"- Vikunja: move to `2.7.1` or later.","reach":"internet","title":"Vikunja: login endpoints accept cross-site form posts, enabling login CSRF","impact":"medium","summary":"Vikunja 2.0.0 before 2.7.1 accepts form-encoded requests on its /api/v2 login and OIDC callback endpoints without CSRF or Origin checks. A malicious page can make a victim's browser log in as the attacker's account, so data the victim then adds lands in the attacker's account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"victim's session switched to attacker account, victim data stored there","analyst_note":"","how_to_check":"- Check the installed Vikunja version; affected range is `2.0.0` up to but not including `2.7.1`.\n- Look for a Vikunja instance on `/api/v2` login or OIDC callback endpoints reachable from the internet.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","version-2.7.1-or-later"],"who_is_affected":"Teams that self-host Vikunja 2.0.0 through 2.7.0 and expose its login endpoints to users. Exposure requires a user to visit an attacker-controlled page while logged in or during login; instances on a managed host that has already upgraded are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000706,"input_tokens":4317,"output_tokens":548,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123495':15A,18A '-2026':14A,17A '/api/v2':35B,85C '2.0.0':25B,75C '2.7.1':27B,77C 'accept':4A,28B,78C 'account':61B,73B,107C,130C 'add':67B,137C 'attack':59B,71B,104C,117C,128C 'bodi':82C 'browser':54B 'callback':39B,89C 'check':45B,95C 'code':122C 'credenti':119C 'cross':6A,99C 'cross-sit':5A,98C 'csrf':12A,42B,92C 'cve':13A,16A 'data':63B,133C 'enabl':10A,96C 'encod':31B,81C 'endpoint':3A,40B,90C 'expos':132C 'forgeri':102C 'form':8A,30B,80C 'form-encod':29B,79C 'host':22B 'land':68B 'log':55B 'login':2A,11A,36B,86C,97C 'lure':109C 'make':50B 'malici':47B 'oidc':38B,88C,121C 'origin':44B,94C 'packag':19B 'page':48B,114C 'post':9A,115C 'request':32B,101C 'self':21B 'self-host':20B 'site':7A,100C 'switch':123C 'victim':52B,65B,111C,125C,135C 'vikunja':1A,23B,24B,74C 'without':41B,91C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Vikunja 2.0.0 through 2.7.0 and expose its login endpoints to users. Exposure requires a user to visit an attacker-controlled page while logged in or during login; instances on a managed host that has already upgraded are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","vikunja"],"campaign_type":null,"search_a":"'-123495':15A,18A '-2026':14A,17A 'accept':4A 'cross':6A 'cross-sit':5A 'csrf':12A 'cve':13A,16A 'enabl':10A 'endpoint':3A 'form':8A 'login':2A,11A 'post':9A 'site':7A 'vikunja':1A","search_b":"'/api/v2':35B '2.0.0':25B '2.7.1':27B 'accept':28B 'account':61B,73B 'add':67B 'attack':59B,71B 'browser':54B 'callback':39B 'check':45B 'csrf':42B 'data':63B 'encod':31B 'endpoint':40B 'form':30B 'form-encod':29B 'host':22B 'land':68B 'log':55B 'login':36B 'make':50B 'malici':47B 'oidc':38B 'origin':44B 'packag':19B 'page':48B 'request':32B 'self':21B 'self-host':20B 'victim':52B,65B 'vikunja':23B,24B 'without':41B","search_c":"'/api/v2':85C '2.0.0':75C '2.7.1':77C 'accept':78C 'account':107C,130C 'add':137C 'attack':104C,117C,128C 'bodi':82C 'callback':89C 'check':95C 'code':122C 'credenti':119C 'cross':99C 'cross-sit':98C 'csrf':92C 'data':133C 'enabl':96C 'encod':81C 'endpoint':90C 'expos':132C 'forgeri':102C 'form':80C 'form-encod':79C 'login':86C,97C 'lure':109C 'oidc':88C,121C 'origin':94C 'page':114C 'post':115C 'request':101C 'site':100C 'switch':123C 'victim':111C,125C,135C 'vikunja':74C 'without':91C","first_public_at":"2026-10-22T10:00:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123495","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123495","severity":null,"published_at":"2026-11-08T02:16:36+00:00","modified_at":"2026-11-08T02:16:36+00:00","first_seen_at":"2026-11-08T02:21:07+00:00","fetched_at":"2026-11-08T02:21:07+00:00","note":null}],"documents":[{"id":99139,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-frf4-3prf-3vch","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:00:15+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99140,"url":"https://www.vulncheck.com/advisories/vikunja-2.0.0-before-2.7.1-login-csrf-via-api-v2-login-and-oidc-callback","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}