---
id: "CVE-2026-123497"
page: "https://infrastack.ai/live/CVE-2026-123497"
kind: "vulnerability"
aliases: ["CVE-2026-123497"]
title: "Vikunja veans: on-path attacker forces plain HTTP, capturing passwords and tokens"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "veans", "vikunja"]
not_affected_if: ["https-only-network", "veans-not-used", "version-2.7.1-or-later"]
published_at: "2026-11-08T02:16:37+00:00"
first_seen_at: "2026-11-08T02:21:07+00:00"
updated_at: "2026-11-08T02:23:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123497", "first_seen_at": "2026-11-08T02:21:07+00:00"}]
exploit_sources: []
---

# Vikunja veans: on-path attacker forces plain HTTP, capturing passwords and tokens

Link for people: https://infrastack.ai/live/CVE-2026-123497 (this .md is for agents)

The veans command-line client for Vikunja falls back to plain HTTP during init and login when HTTPS is blocked. An on-path attacker can capture passwords, TOTP codes, bot tokens and persistent API traffic.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed veans version with `veans --version` (exact flag unknown from sources).
- Confirm whether the server URL configured for veans uses `https://`.

## Fix

- veans: upgrade to `2.7.1` or later.

## Timeline

- 2026-11-08T02:21:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123497

## Documents

- [advisory] Vendor advisory: github.com https://github.com/go-vikunja/vikunja/security/advisories/GHSA-wqw2-rgwv-99qx
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vikunja-veans-before-2.7.1-https-to-http-downgrade-in-server-discovery

## From the sources

Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_