Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123495Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback
Medium 4.6
In plain English
A medium-severity cross-site request forgery in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)4.6Medium
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or Origin checks, enabling login cross-site request forgery. An attacker with an account can lure a victim to a page posting the attacker's credentials or OIDC code, switching the victim into the attacker's account and exposing data the victim then adds.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 2.0.0 – before 2.7.1 |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
References
- GitHub Security Advisory (GHSA-frf4-3prf-3vch) vendor-advisory
- VulnCheck Advisory: Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback third-party-advisory