Live › vulnerability › CVE-2026-62367
Go to dashboardVikunja's OIDC login fallback links an SSO login to an existing local account by matching only the email claim, without checking email_verified or requiring the local password. An attacker who can get a token from the configured identity provider with the victim's email can log in as that victim with a full session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| code.vikunja.io/api | go | all versions | – |
1.0.0 and 2.3.0 inclusive2.4.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider emailfallback option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local (username+password) account using only the email claim from the IdP. The fallback never checks an email_verified (or Microsoft xms_edov) signal and never requires the matched account's password. An attacker who can obtain a token from the configured issuer carrying a victim's email logs in as that victim with a full session, with no consent or interaction from the victim. Version 2.4.0 fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-62367")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.