EUVD-2026-21414
GHSA-8jvc-mcx6-r4cg
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
5DescriptionGitHub Advisory
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped. This vulnerability is fixed in 2.3.0.
AnalysisAI
Authentication bypass in Vikunja task management platform allows unauthenticated attackers to circumvent two-factor authentication when OIDC email-based user matching is enabled. The OIDC callback handler issues complete JWT tokens without validating TOTP enrollment status, enabling full account access to users with configured TOTP protection when matched through OIDC email fallback. Affects versions prior to 2.3.0. No public exploit identified at time of analysis.
Technical ContextAI
CWE-287 improper authentication flaw in OIDC integration logic. Callback handler fails to enforce TOTP validation step after successful OIDC authentication when user matching occurs via email attribute rather than native OIDC identifiers. JWT generation proceeds without checking enrolled second-factor state in user record, creating authentication downgrade path.
RemediationAI
Vendor-released patch: Upgrade to Vikunja 2.3.0 immediately to resolve authentication bypass. Version 2.3.0 implements mandatory TOTP validation in OIDC flow regardless of email-based matching. Organizations unable to upgrade should disable OIDC email fallback matching and use native OIDC identifiers exclusively until patch deployment. Review authentication logs for suspicious JWT issuance patterns to TOTP-enrolled accounts via OIDC flow. Verify TOTP enforcement after upgrade by testing OIDC login with TOTP-enabled accounts. Official advisory: https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8jvc-mcx6-r4cg
Weak password policy in Vikunja task management before 2.0.0 allows users to set trivially guessable passwords. PoC avai
Stored cross-site scripting (XSS) in Vikunja prior to version 2.0.0 allows authenticated attackers to steal authenticati
Vikunja before version 2.0.0 contains a path traversal vulnerability in its backup restoration function that fails to va
Vikunja is an open-source self-hosted task management platform. [CVSS 6.1 MEDIUM]
Business logic vulnerability in Vikunja task management platform before 2.1.0 allows incomplete resource cleanup, potent
Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any
Instance-wide data breach in Vikunja before 2.2.1 lets remote attackers exfiltrate and destroy every file attachment acr
Principal type confusion in Vikunja (versions 0.22.0-2.3.0) allows an authenticated low-privilege attacker to fully cont
Principal-type confusion in Vikunja through 2.4.0 allows an attacker holding a valid link-share JWT to impersonate arbit
Vikunja prior to version 2.3.0 fails to validate link share permissions against server state during JWT authentication,
The Vikunja Desktop Electron application fails to validate or allowlist URI schemes before passing URLs from window.open
Cross-site scripting (XSS) in Vikunja prior to version 1.1.0 allows authenticated attackers to execute arbitrary JavaScr
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today