CVE-2026-123497 · Package
NO FIX YET · SEE WHAT TO DO
The veans command-line client for Vikunja falls back to plain HTTP during init and login when HTTPS is blocked. An on-path attacker can capture passwords, TOTP codes, bot tokens and persistent API traffic.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run the veans client to connect to a Vikunja server, especially on untrusted networks where an attacker could sit on the path and block HTTPS. Users who only use the Vikunja web app or server are not described as affected by this flaw.
Not affected if https-only-network, veans-not-used, version-2.7.1-or-later
Who cares self-hosted, veans, vikunja
veans --version (exact flag unknown from sources).https://.2.7.1 or later.Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.