Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123494Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks
Low 3.5
In plain English
A low-severity cross-site request forgery in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft To Do, and Trello migration OAuth callbacks lack a bound state parameter. Attackers can authorize their own account, keep the unused callback code or token, and lure a logged-in victim to the migration callback route to auto-import attacker-chosen projects and tasks containing phishing links.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 0 – before 2.7.1 |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
References
- GitHub Security Advisory (GHSA-xgw3-ccqg-f6ww) vendor-advisory
- VulnCheck Advisory: Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks third-party-advisory