{"id":"CVE-2026-62367","kind":"vulnerability","aliases":["CVE-2026-62367","GHSA-xv7q-fvmc-jx96","GO-2026-6758"],"related":[],"title":"Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover in code.vikunja.io/api","description":"Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local (username+password) account using only the `email` claim from the IdP. The fallback never checks an `email_verified` (or Microsoft `xms_edov`) signal and never requires the matched account's password. An attacker who can obtain a token from the configured issuer carrying a victim's email logs in as that victim with a full session, with no consent or interaction from the victim. Version 2.4.0 fixes the issue.","summary":"Vikunja's OIDC login fallback links an SSO login to an existing local account by matching only the email claim, without checking email_verified or requiring the local password. An attacker who can get a token from the configured identity provider with the victim's email can log in as that victim with a full session.","severity":"high","cvss":7.5,"epss":0.00089,"exploited":false,"exploited_at":null,"products":[{"name":"code.vikunja.io/api","fixed":[],"affected":"all versions","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","oidc","package","self-hosted","vikunja"],"not_affected_if":["emailfallback-disabled","oidc-not-used","version-2.4.0-or-later"],"how_to_check":"Check whether the per-provider emailfallback option is enabled on any OpenID Connect provider in the Vikunja configuration. Confirm the running version is between 1.0.0 and 2.3.0 inclusive.","fix":"Upgrade code.vikunja.io/api to 2.4.0 or later. Until then, disable emailfallback on OIDC providers (unknown whether a config-only workaround fully closes the issue).","status":"open","published_at":"2026-10-09T21:17:05+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:55:58+00:00","updated_at":"2026-10-23T19:55:58+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T19:55:58Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade code.vikunja.io/api to 2.4.0 or later. Until then, disable emailfallback on OIDC providers (unknown whether a config-only workaround fully closes the issue).","summary":"Vikunja's OIDC login fallback links an SSO login to an existing local account by matching only the email claim, without checking email_verified or requiring the local password. An attacker who can get a token from the configured identity provider with the victim's email can log in as that victim with a full session.","category":"package","who_cares":["self-hosted","oidc","vikunja","go"],"confidence":0.85,"analyst_note":"","how_to_check":"Check whether the per-provider emailfallback option is enabled on any OpenID Connect provider in the Vikunja configuration. Confirm the running version is between 1.0.0 and 2.3.0 inclusive.","needs_analyst":false,"not_affected_if":["emailfallback-disabled","oidc-not-used","version-2.4.0-or-later"],"severity_if_unknown":"high"},"cost_usd":0.000658,"input_tokens":2261,"output_tokens":864,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':21A,29A,32A '-62367':22A,33A '-6758':30A '/api':19A,36A '1.0.0':114C '2.3.0':116C '2.4.0':208C 'account':6A,14A,57B,145C,171C 'administr':119C 'attack':74B,175C 'carri':185C 'check':65B,157C 'claim':63B,150C 'code.vikunja.io':18A,35A 'code.vikunja.io/api':17A,34A 'configur':82B,183C 'connect':130C 'consent':201C 'cve':20A,31A 'edov':164C 'email':4A,9A,62B,66B,89B,149C,159C,189C 'email-fallback':3A 'emailfallback':125C 'enabl':11A,120C 'exist':55B,141C 'fallback':5A,48B,155C 'fix':209C 'full':98B,197C 'fvmc':26A 'get':77B 'ghsa':24A 'ghsa-xv7q-fvmc-jx96':23A 'go':28A,37B 'host':42B,108C 'ident':83B 'idp':153C 'ignor':8A 'interact':203C 'issu':211C 'issuer':184C 'jx96':27A 'link':7A,49B,133C 'local':13A,56B,71B,142C 'local-account':12A 'log':91B,190C 'login':47B,52B,136C 'manag':110C 'match':59B,170C 'microsoft':162C 'never':156C,167C 'obtain':178C 'oidc':2A,38B,46B 'open':104C 'open-sourc':103C 'openid':129C 'option':126C 'packag':39B 'password':72B,144C,173C 'per':123C 'per-provid':122C 'platform':111C 'pre':140C 'pre-exist':139C 'provid':84B,124C,131C 'requir':69B,168C 'self':41B,107C 'self-host':40B,106C 'session':99B,198C 'signal':165C 'sourc':105C 'sso':51B,135C 'takeov':15A 'task':109C 'token':79B,180C 'use':146C 'usernam':143C 'verifi':10A,67B,160C 'version':113C,207C 'victim':87B,95B,187C,194C,206C 'vikunja':1A,43B,44B,100C,132C 'without':64B 'xms':163C 'xv7q':25A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-09T21:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6758","url":"https://pkg.go.dev/vuln/GO-2026-6758","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-62367","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62367","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-62367","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62367","severity":null,"published_at":"2026-10-09T21:17:05+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}