Vikunja < 2.1.0 - Persistent Account Takeover via Password Reset Token Reuse
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2026-28268. PoCs published by exploitintel.
AI-analyzed exploit summary The repository contains functional exploit code demonstrating CVE-2026-28268, a critical authentication bypass vulnerability in Vikunja < 2.1.0 due to password reset token reuse. The PoCs include token reuse, persistent backdoor, and raw HTTP socket exploits.
Description
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever. This allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls. Version 2.1.0 contains a patch for the issue.
Exploits (1)
The repository contains functional exploit code demonstrating CVE-2026-28268, a critical authentication bypass vulnerability in Vikunja < 2.1.0 due to password reset token reuse. The PoCs include token reuse, persistent backdoor, and raw HTTP socket exploits.
References (3)
Related Analysis
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
