{"id":"GHSA-4hv6-xc92-j86g","kind":"vulnerability","aliases":["GHSA-4hv6-xc92-j86g","GO-2026-6715"],"related":[],"title":"Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api","description":"Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: .","summary":"The WebSocket authentication in the Vikunja Go module code.vikunja.io/api does not check server-side session state, so a session that has been revoked can keep receiving live push messages. An attacker holding a revoked session token can continue to see real-time updates to the user's tasks and projects.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"code.vikunja.io/api","fixed":[],"affected":"all versions","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","self-hosted","vikunja"],"not_affected_if":["no-websocket-use","vikunja-not-deployed"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:15:27+00:00","updated_at":"2026-10-23T20:15:27+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:15:27Z","model":"claude-haiku-5-5","output":{"fix":"unknown","summary":"The WebSocket authentication in the Vikunja Go module code.vikunja.io/api does not check server-side session state, so a session that has been revoked can keep receiving live push messages. An attacker holding a revoked session token can continue to see real-time updates to the user's tasks and projects.","category":"package","who_cares":["go","vikunja","self-hosted"],"confidence":0.6,"analyst_note":"Sources list no fixed version and no severity; check https://pkg.go.dev/vuln/GO-2026-6715 and the GHSA advisory for the fixed version and affected version range.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-websocket-use","vikunja-not-deployed"],"severity_if_unknown":"unknown"},"cost_usd":0.000348,"input_tokens":2103,"output_tokens":275,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':27A '-6715':28A '/api':20A,36A,53B '/api.':116C '4hv6':23A,31A 'addit':125C,157C 'advisori':120C 'affect':158C 'attack':76B 'authent':3A,45B,99C 'automat':131C 'caus':141C 'check':56B 'code.vikunja.io':19A,35A,52B,115C 'code.vikunja.io/api':18A,34A,51B 'code.vikunja.io/api.':114C 'contain':124C 'continu':83B 'could':128C 'edit':152C 'fals':143C 'false-posit':142C 'ghsa':22A,30A 'ghsa-4hv6-xc92-j86g':21A,29A 'go':26A,37B,49B,135C 'hold':77B 'host':41B 'ignor':4A,100C 'j86g':25A,33A 'keep':13A,70B,109C 'live':15A,72B,111C 'map':132C 'messag':74B 'modul':50B,136C,159C 'note':117C 'packag':38B 'pleas':149C 'posit':144C 'project':96B 'push':16A,73B,112C 'real':87B 'real-tim':86B 'receiv':14A,71B,110C 'report':123C,145C,155C 'revok':11A,68B,79B,107C 'scanner':148C 'see':85B 'self':40B 'self-host':39B 'server':6A,58B,102C 'server-sid':5A,57B,101C 'session':8A,12A,60B,64B,80B,104C,108C 'side':7A,59B,103C 'sourc':119C 'standard':134C 'state':9A,61B,105C 'suggest':150C 'task':94B 'time':88B 'token':81B 'updat':89B 'user':92B 'version':126C,137C,161C 'vikunja':1A,42B,48B,97C 'vulner':147C 'websocket':2A,44B,98C 'xc92':24A,32A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:08:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6715","url":"https://pkg.go.dev/vuln/GO-2026-6715","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}