What is the CVSS score of CVE-2026-28268?

CVE-2026-28268 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Vikunja are affected by CVE-2026-28268?

Vikunja task management deployments running versions prior to 2.1.0 face a critical authentication bypass risk where password reset tokens can be reused indefinitely, allowing attackers to take over…. A patch is available.

How to fix or mitigate CVE-2026-28268?

Within 24 hours: Identify all Vikunja instances in your environment and document current versions; notify users to change passwords immediately and monitor for suspicious account access. Within 7 days: Upgrade all Vikunja deployments to version 2.1.0 or later and force password resets for all users post-upgrade. Within 30 days: Conduct access logs review for the past 90 days to identify unauthorized account activity; implement MFA for Vikunja accounts and establish monitoring for anomalous password reset requests.

Vikunja CVE-2026-28268

CRITICAL

Incomplete Cleanup (CWE-459)

2026-02-27 security-advisories@github.com

GHSA-rfjg-6m84-crj2

Authentication Bypass Vikunja Suse

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Mar 06, 2026 - 21:03 nvd

Patch available

CVE Published

Feb 27, 2026 - 21:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever. This allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls. Version 2.1.0 contains a patch for the issue.

AnalysisAI

Business logic vulnerability in Vikunja task management platform before 2.1.0 allows incomplete resource cleanup, potentially enabling unauthorized access to shared resources after user removal.