CVE-2026-123521 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja, an open-source task manager, does not limit failed attempts on its re-authentication endpoint for disabling two-factor login (TOTP). An attacker holding a stolen session can guess the account password without lockout, then turn off TOTP and keep access to the account.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host or run Vikunja below 2.7.1. An attacker needs an already-valid session token, such as one stolen from a browser or device, so the risk is limited to accounts with a live session. Instances that run only the latest release, or that do not use TOTP, are less exposed to the takeover path.
Not affected if version-2.7.1-or-later
Who cares self-hosted, totp, vikunja
2.7.1./user/settings/totp/disable route in your deployed build's API.2.7.1 or later.Vikunja before 2.7.1 contains an improper restriction of excessive authentication attempts vulnerability that allows session holders to brute-force account passwords via unthrottled re-authentication endpoints. Attackers with a stolen session can guess the password via /user/settings/totp/disable without lockout, then disable TOTP without a code for persistent account takeover.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.