Log in Start free

Vulnerability · Published Apr 10, 2026 · Assigned by GitHub_M

CVE-2026-35597Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout

Medium 5.9

In plain English

A medium-severity security flaw in vikunja from go-vikunja. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.3%top 77.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the TOTP failed-attempt lockout mechanism is non-functional due to a database transaction handling bug. When a TOTP validation fails, the login handler in pkg/routes/api/v1/login.go calls HandleFailedTOTPAuth and then unconditionally rolls back. HandleFailedTOTPAuth in pkg/user/totp.go uses an in-memory counter (key-value store) to track failed attempts. When the counter reaches 10, it calls user.SetStatus(s, StatusAccountLocked) on the same database session s. Because the login handler always rolls back after a TOTP failure, the StatusAccountLocked write is undone. The in-memory counter correctly increments past 10, so the lockout code executes on every subsequent attempt, but the database write is rolled back every time. This allows unlimited brute-force attempts against TOTP codes. This vulnerability is fixed in 2.3.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gocode.vikunja.io/api2.3.0GHSA-fgfv-pv97-6cmj
Gocode.vikunja.io/apino fix listedGO-2026-5362

Affected products (as reported)

VendorProductVersions
go-vikunja vikunja < 2.3.0

Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References