Live › vulnerability › CVE-2026-91973
Go to dashboardThe Vikunja Go module code.vikunja.io/api has no rate limit on its CalDAV and feeds BasicAuth endpoints, so the brute-force protection that applies to normal logins does not apply there. An attacker can guess account passwords through those endpoints and log in as the user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| code.vikunja.io/api | go | all versions | – |
v2.6.0 as affectedUpgrade code.vikunja.io/api to v2.6.0 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords in code.vikunja.io/api.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: code.vikunja.io/api before v2.6.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-91973")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.