{"id":"CVE-2026-123513","kind":"vulnerability","aliases":["CVE-2026-123513"],"related":[],"title":"Vikunja: stored auth tokens leak to attacker-chosen API URL","description":"Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer token and desktop OAuth refresh token are sent to the attacker's server, enabling account takeover.","summary":"Vikunja before 2.7.1 keeps login tokens in browser storage when a user switches the frontend API URL, so the bearer token and desktop OAuth refresh token go to the attacker's server. An attacker who gets a user to change that URL can take over the account.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","vikunja","web-frontend"],"not_affected_if":["fixed-version","managed-hosting"],"how_to_check":"- Check the installed Vikunja version and confirm it is `2.7.1` or later.\n- Review whether users can be sent to a link that changes the frontend API URL.","fix":"- Vikunja: move to `2.7.1` or later.","status":"open","published_at":"2026-11-08T02:16:40+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","triaged_at":"2026-11-08T02:23:22+00:00","updated_at":"2026-11-08T02:23:22+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:23:22Z","model":"claude-haiku-5-5","output":{"fix":"- Vikunja: move to `2.7.1` or later.","reach":"internet","title":"Vikunja: stored auth tokens leak to attacker-chosen API URL","impact":"high","summary":"Vikunja before 2.7.1 keeps login tokens in browser storage when a user switches the frontend API URL, so the bearer token and desktop OAuth refresh token go to the attacker's server. An attacker who gets a user to change that URL can take over the account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","web-frontend"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker takes over user accounts via stolen tokens","analyst_note":"","how_to_check":"- Check the installed Vikunja version and confirm it is `2.7.1` or later.\n- Review whether users can be sent to a link that changes the frontend API URL.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","managed-hosting"],"who_is_affected":"Teams that self-host or run a Vikunja instance before 2.7.1 and have users who log in through the web or desktop frontend. The exposure depends on users being induced to switch the API URL, so instances only reached through a fixed, trusted URL are less exposed. unknown whether managed hosting is affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":4294,"output_tokens":508,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123513':14A,17A '-2026':13A,16A '2.7.1':28B,75C 'account':72B,124C 'allow':82C 'api':10A,41B,96C 'attack':8A,55B,59B,83C,120C 'attacker-chosen':7A 'auth':3A,87C 'bearer':45B,109C 'browser':33B 'chang':65B 'checkandsetapiurl':99C 'chosen':9A 'contain':76C 'credenti':78C 'cve':12A,15A 'desktop':48B,112C 'enabl':123C 'exposur':79C 'frontend':25B,40B,95C 'get':61B 'go':52B 'host':21B 'independ':103C 'induc':90C 'keep':29B 'leak':5A 'leav':100C 'localstorag':104C 'login':30B 'oauth':49B,113C 'origin':102C 'origin-independ':101C 'packag':18B 'place':107C 'refresh':50B,114C 'self':20B 'self-host':19B 'sent':117C 'server':57B,122C 'steal':85C 'storag':34B 'store':2A,86C 'switch':38B,93C 'take':69B 'takeov':125C 'token':4A,31B,46B,51B,88C,105C,110C,115C 'url':11A,42B,67B,97C 'user':37B,63B,91C 'vikunja':1A,22B,26B,73C 'vulner':80C 'web':24B 'web-frontend':23B","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host or run a Vikunja instance before 2.7.1 and have users who log in through the web or desktop frontend. The exposure depends on users being induced to switch the API URL, so instances only reached through a fixed, trusted URL are less exposed. unknown whether managed hosting is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","vikunja","webfrontend"],"campaign_type":null,"search_a":"'-123513':14A,17A '-2026':13A,16A 'api':10A 'attack':8A 'attacker-chosen':7A 'auth':3A 'chosen':9A 'cve':12A,15A 'leak':5A 'store':2A 'token':4A 'url':11A 'vikunja':1A","search_b":"'2.7.1':28B 'account':72B 'api':41B 'attack':55B,59B 'bearer':45B 'browser':33B 'chang':65B 'desktop':48B 'frontend':25B,40B 'get':61B 'go':52B 'host':21B 'keep':29B 'login':30B 'oauth':49B 'packag':18B 'refresh':50B 'self':20B 'self-host':19B 'server':57B 'storag':34B 'switch':38B 'take':69B 'token':31B,46B,51B 'url':42B,67B 'user':37B,63B 'vikunja':22B,26B 'web':24B 'web-frontend':23B","search_c":"'2.7.1':75C 'account':124C 'allow':82C 'api':96C 'attack':83C,120C 'auth':87C 'bearer':109C 'checkandsetapiurl':99C 'contain':76C 'credenti':78C 'desktop':112C 'enabl':123C 'exposur':79C 'frontend':95C 'independ':103C 'induc':90C 'leav':100C 'localstorag':104C 'oauth':113C 'origin':102C 'origin-independ':101C 'place':107C 'refresh':114C 'sent':117C 'server':122C 'steal':85C 'store':86C 'switch':93C 'takeov':125C 'token':88C,105C,110C,115C 'url':97C 'user':91C 'vikunja':73C 'vulner':80C","first_public_at":"2026-10-22T10:04:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123513","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123513","severity":null,"published_at":"2026-11-08T02:16:40+00:00","modified_at":"2026-11-08T02:16:40+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","fetched_at":"2026-11-08T02:21:08+00:00","note":null}],"documents":[{"id":99175,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rj93-wmch-2crq","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:04:27+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99176,"url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-auth-token-leak-via-api-url-change","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}