---
id: "CVE-2026-62367"
kind: "vulnerability"
aliases: ["CVE-2026-62367", "GHSA-xv7q-fvmc-jx96", "GO-2026-6758"]
title: "Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover in code.vikunja.io/api"
severity: "high"
cvss: 7.5
epss: 0.00089
exploited: false
status: "open"
category: "package"
products: [{"name": "code.vikunja.io/api", "fixed": [], "affected": "all versions", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "oidc", "package", "self-hosted", "vikunja"]
not_affected_if: ["emailfallback-disabled", "oidc-not-used", "version-2.4.0-or-later"]
published_at: "2026-10-09T21:17:05+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T19:55:58+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6758", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-62367", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62367", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover in code.vikunja.io/api

Vikunja's OIDC login fallback links an SSO login to an existing local account by matching only the email claim, without checking email_verified or requiring the local password. An attacker who can get a token from the configured identity provider with the victim's email can log in as that victim with a full session.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:code.vikunja.io/api affected all versions fixed ?

## How to check

Check whether the per-provider emailfallback option is enabled on any OpenID Connect provider in the Vikunja configuration. Confirm the running version is between 1.0.0 and 2.3.0 inclusive.

## Fix

Upgrade code.vikunja.io/api to 2.4.0 or later. Until then, disable emailfallback on OIDC providers (unknown whether a config-only workaround fully closes the issue).

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6758
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-62367
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62367

## From the sources

Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local (username+password) account using only the `email` claim from the IdP. The fallback never checks an `email_verified` (or Microsoft `xms_edov`) signal and never requires the matched account's password. An attacker who can obtain a token from the configured issuer carrying a victim's email logs in as that victim with a full session, with no consent or interaction from the victim. Version 2.4.0 fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_