CVE-2026-123513 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja before 2.7.1 keeps login tokens in browser storage when a user switches the frontend API URL, so the bearer token and desktop OAuth refresh token go to the attacker's server. An attacker who gets a user to change that URL can take over the account.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host or run a Vikunja instance before 2.7.1 and have users who log in through the web or desktop frontend. The exposure depends on users being induced to switch the API URL, so instances only reached through a fixed, trusted URL are less exposed. unknown whether managed hosting is affected.
Not affected if fixed-version, managed-hosting
Who cares self-hosted, vikunja, web-frontend
2.7.1 or later.2.7.1 or later.Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer token and desktop OAuth refresh token are sent to the attacker's server, enabling account takeover.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.