EUVD-2026-21414
GHSA-8jvc-mcx6-r4cg
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4Description
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped. This vulnerability is fixed in 2.3.0.
Analysis
Authentication bypass in Vikunja task management platform allows unauthenticated attackers to circumvent two-factor authentication when OIDC email-based user matching is enabled. The OIDC callback handler issues complete JWT tokens without validating TOTP enrollment status, enabling full account access to users with configured TOTP protection when matched through OIDC email fallback. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: audit Vikunja deployment to confirm OIDC and TOTP are both enabled and identify affected user accounts. Within 7 days: disable OIDC email-based user matching as an interim control, or disable OIDC authentication entirely if possible, and require TOTP-only or password-based authentication. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today