Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123497Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery
Medium 6.8
In plain English
A medium-severity security flaw in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 0 – before 2.7.1 |
Weakness: CWE-319 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
References
- GitHub Security Advisory (GHSA-wqw2-rgwv-99qx) vendor-advisory
- VulnCheck Advisory: Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery third-party-advisory