{"id":"CVE-2026-123497","kind":"vulnerability","aliases":["CVE-2026-123497"],"related":[],"title":"Vikunja veans: on-path attacker forces plain HTTP, capturing passwords and tokens","description":"Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.","summary":"The veans command-line client for Vikunja falls back to plain HTTP during init and login when HTTPS is blocked. An on-path attacker can capture passwords, TOTP codes, bot tokens and persistent API traffic.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","veans","vikunja"],"not_affected_if":["https-only-network","veans-not-used","version-2.7.1-or-later"],"how_to_check":"- Check the installed veans version with `veans --version` (exact flag unknown from sources).\n- Confirm whether the server URL configured for veans uses `https://`.","fix":"- veans: upgrade to `2.7.1` or later.","status":"open","published_at":"2026-11-08T02:16:37+00:00","first_seen_at":"2026-11-08T02:21:07+00:00","triaged_at":"2026-11-08T02:23:22+00:00","updated_at":"2026-11-08T02:23:22+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:23:22Z","model":"claude-haiku-5-5","output":{"fix":"- veans: upgrade to `2.7.1` or later.","reach":"network","title":"Vikunja veans: on-path attacker forces plain HTTP, capturing passwords and tokens","impact":"high","summary":"The veans command-line client for Vikunja falls back to plain HTTP during init and login when HTTPS is blocked. An on-path attacker can capture passwords, TOTP codes, bot tokens and persistent API traffic.","audience":"developers","category":"package","nicknames":[],"who_cares":["vikunja","veans","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Passwords, TOTP codes and bot tokens captured in cleartext","analyst_note":"","how_to_check":"- Check the installed veans version with `veans --version` (exact flag unknown from sources).\n- Confirm whether the server URL configured for veans uses `https://`.","plain_action":"","needs_analyst":false,"not_affected_if":["veans-not-used","https-only-network","version-2.7.1-or-later"],"who_is_affected":"Teams that run the veans client to connect to a Vikunja server, especially on untrusted networks where an attacker could sit on the path and block HTTPS. Users who only use the Vikunja web app or server are not described as affected by this flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000677,"input_tokens":4293,"output_tokens":496,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123497':16A,19A '-2026':15A,18A '2.7.1':66C 'accept':96C 'allow':75C 'api':61B,111C 'attack':6A,51B,79C,89C 'back':35B 'block':46B,91C 'bot':57B,106C 'captur':10A,53B,101C 'cleartext':110C 'client':31B 'code':56B,104C 'command':29B 'command-lin':28B 'contain':67C 'cve':14A,17A 'discoveri':95C 'downgrad':70C 'fall':34B 'forc':7A,81C 'host':23B 'http':9A,38B,83C,99C 'https':44B,92C 'init':40B,86C 'line':30B 'login':42B,88C 'on-path':3A,48B,76C 'packag':20B 'password':11A,54B,102C 'path':5A,50B,78C 'persist':60B,109C 'plain':8A,37B,82C 'port':93C 'protocol':69C 'respons':100C 'self':22B 'self-host':21B 'servercandid':73C 'token':13A,58B,107C 'totp':55B,103C 'traffic':62B,112C 'unverifi':98C 'vean':2A,24B,27B,64C,85C 'vikunja':1A,25B,33B,63C 'vulner':71C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the veans client to connect to a Vikunja server, especially on untrusted networks where an attacker could sit on the path and block HTTPS. Users who only use the Vikunja web app or server are not described as affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","veans","vikunja"],"campaign_type":null,"search_a":"'-123497':16A,19A '-2026':15A,18A 'attack':6A 'captur':10A 'cve':14A,17A 'forc':7A 'http':9A 'on-path':3A 'password':11A 'path':5A 'plain':8A 'token':13A 'vean':2A 'vikunja':1A","search_b":"'api':61B 'attack':51B 'back':35B 'block':46B 'bot':57B 'captur':53B 'client':31B 'code':56B 'command':29B 'command-lin':28B 'fall':34B 'host':23B 'http':38B 'https':44B 'init':40B 'line':30B 'login':42B 'on-path':48B 'packag':20B 'password':54B 'path':50B 'persist':60B 'plain':37B 'self':22B 'self-host':21B 'token':58B 'totp':55B 'traffic':62B 'vean':24B,27B 'vikunja':25B,33B","search_c":"'2.7.1':66C 'accept':96C 'allow':75C 'api':111C 'attack':79C,89C 'block':91C 'bot':106C 'captur':101C 'cleartext':110C 'code':104C 'contain':67C 'discoveri':95C 'downgrad':70C 'forc':81C 'http':83C,99C 'https':92C 'init':86C 'login':88C 'on-path':76C 'password':102C 'path':78C 'persist':109C 'plain':82C 'port':93C 'protocol':69C 'respons':100C 'servercandid':73C 'token':107C 'totp':103C 'traffic':112C 'unverifi':98C 'vean':64C,85C 'vikunja':63C 'vulner':71C","first_public_at":"2026-10-22T10:01:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123497","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123497","severity":null,"published_at":"2026-11-08T02:16:37+00:00","modified_at":"2026-11-08T02:16:37+00:00","first_seen_at":"2026-11-08T02:21:07+00:00","fetched_at":"2026-11-08T02:21:07+00:00","note":null}],"documents":[{"id":99143,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-wqw2-rgwv-99qx","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:01:37+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99144,"url":"https://www.vulncheck.com/advisories/vikunja-veans-before-2.7.1-https-to-http-downgrade-in-server-discovery","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}