CVE-2026-123528 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja, an open-source task manager, fails to check session and account status for some tokens, so a revoked token still authenticates. An attacker holding a stolen token can keep access after logout, password reset or account disabling, including by minting new OAuth sessions or tk_ API tokens.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host Vikunja and rely on logout, password reset or account disabling to cut off access. Hosted or unaffected versions at or above 2.7.1 are not exposed; the sources do not say whether any other configuration changes exposure.
Not affected if version-2.7.1-or-later
Who cares self-hosted, vikunja
vikunja version or the image tag in your deployment2.7.1 and later (per the advisory title: before 2.7.1 is affected)Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account disabling, mint OAuth sessions via /oauth/authorize or tk_ API tokens for persistent access.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.