EUVD-2026-21414
GHSA-8jvc-mcx6-r4cg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConfigure OIDC provider with target user email
-
DeliveryTrigger OIDC callback in Vikunja
-
ExploitBypass TOTP verification check
-
ExecutionObtain full JWT token
-
ImpactGain unauthorized account access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Vikunja versions prior to 2.3.0 with OIDC authentication enabled and a local user account having TOTP two-factor authentication enrolled. Attacker performs OIDC login matching the target user's email via OIDC email fallback mechanism, bypassing TOTP requirement. Remote unauthenticated exploitation. |
| Impact | CVSS 7.4 reflects high-impact authentication bypass: unauthenticated attackers can bypass TOTP by exploiting OIDC email matching, gaining full account access without second-factor verification. Network-accessible self-hosted instances are immediately at risk. No KEV or public exploit identified, but the mechanism is straightforward and affects any deployment using OIDC with enrolled 2FA users. |
| Exploit ScenarioDerived | Attacker with target email address registers/authenticates via OIDC provider, triggering email-based user matching. OIDC callback issues full JWT without TOTP validation, granting instant account access regardless of enrolled 2FA. No special privileges or interaction required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Authentication bypass in Vikunja task management platform allows unauthenticated attackers to circumvent two-factor authentication when OIDC email-based user matching is enabled. The OIDC callback handler issues complete JWT tokens without validating TOTP enrollment status, enabling full account access to users with configured TOTP protection when matched through OIDC email fallback. Affects versions prior to 2.3.0. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: Upgrade to Vikunja 2.3.0 immediately to resolve authentication bypass. Version 2.3.0 implements mandatory TOTP validation in OIDC flow regardless of email-based matching. Organizations unable to upgrade should disable OIDC email fallback matching and use native OIDC identifiers exclusively until patch deployment. Review authentication logs for suspicious JWT issuance patterns to TOTP-enrolled accounts via OIDC flow. Verify TOTP enforcement after upgrade by testing OIDC login with TOTP-enabled accounts. Official advisory: https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8jvc-mcx6-r4cg
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-287 improper authentication flaw in OIDC integration logic. Callback handler fails to enforce TOTP validation step after successful OIDC authentication when user matching occurs via email attribute rather than native OIDC identifiers. JWT generation proceeds without checking enrolled second-factor state in user record, creating authentication downgrade path.
Know when Vikunja gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped. This vulnerability is fixed in 2.3.0.
Executive ViewAI
Vikunja task management platform versions prior to 2.3.0 contain an authentication bypass vulnerability that allows unauthenticated attackers to gain full account access to users with two-factor authentication enabled when OIDC-based login is configured with email matching. Organizations using Vikunja with OIDC and TOTP protection face complete circumvention of their second authentication factor, directly compromising user account security and potentially enabling unauthorized access to sensitive task and project data.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable OIDC email-based user matching and require explicit account linking before OIDC login; (2) Temporarily disable OIDC authentication and enforce TOTP with password-based login; (3) Implement network-level access controls to restrict Vikunja login endpoints to trusted networks or VPN; (4) Monitor JWT token issuance logs for anomalous OIDC callback patterns and revoke suspicious sessions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Vikunja Multiple Authorization and Injection
View all 11Weak password policy in Vikunja task management before 2.0.0 allows users to set trivially guessable passwords. PoC avai
Stored cross-site scripting (XSS) in Vikunja prior to version 2.0.0 allows authenticated attackers to steal authenticati
Vikunja before version 2.0.0 contains a path traversal vulnerability in its backup restoration function that fails to va
Vikunja is an open-source self-hosted task management platform. [CVSS 6.1 MEDIUM]
Business logic vulnerability in Vikunja task management platform before 2.1.0 allows incomplete resource cleanup, potent
Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any
Instance-wide data breach in Vikunja before 2.2.1 lets remote attackers exfiltrate and destroy every file attachment acr
Vikunja instances before 2.6.0 expose CalDAV BasicAuth endpoints (/dav, /.well-known, and /feeds) that are not covered b
Vikunja versions before 2.6.0 ship authentication endpoints under /api/v2 (login, register, password-reset, and OAuth to
Vikunja prior to 2.6.0 leaks the secret hash that backs a project's link shares through its single-share read endpoint,
Principal type confusion in Vikunja (versions 0.22.0-2.3.0) allows an authenticated low-privilege attacker to fully cont
Privilege escalation in Vikunja 2.3.0 allows a user who holds a narrowly scoped API token (permissions {"oauth":["author
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Exploit-DB