CVE-2026-34727

HIGH

Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path

Title source: cna

Description

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped. This vulnerability is fixed in 2.3.0.

References (1)

[X_Refsource_Confirm] https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8jvc-mcx6-r4cg

Scores

CVSS v3 7.4

EPSS 0.0004

EPSS Percentile 12.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-287

Status published

Products (3)

code.vikunja.io/api 0 - 2.3.0Go

go-vikunja/vikunja < 2.3.0

vikunja/vikunja < 2.3.0

Published Apr 10, 2026

Tracked Since Apr 10, 2026