Vulnerability · Published Mar 24, 2026 · Assigned by GitHub_M
CVE-2026-33473Vikunja has TOTP Reuse During Validity Window
Medium 5.7
In plain English
A medium-severity improper authentication in vikunja from go-vikunja. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Severity (CVSS 3.1)5.7Medium
Exploit odds (30 days)0.3%top 74.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Vikunja is an open-source self-hosted task management platform. Starting in version 0.13 and prior to version 2.2.1, any user that has enabled 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.2.1 patches the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | code.vikunja.io/api | no fix listed | GO-2026-4805 |
| Go | code.vikunja.io/api | no fix listed | GHSA-p747-qc5p-773r |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | >= 0.13, < 2.2.1 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
References
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-p747-qc5p-773r x_refsource_CONFIRM
- https://vikunja.io/changelog/vikunja-v2.2.0-was-released x_refsource_MISC
- https://vikunja.io/changelog/vikunja-v2.2.2-was-released x_refsource_MISC