Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123513Vikunja before 2.7.1 Auth Token Leak via API URL Change
Medium 6.8
In plain English
A medium-severity security flaw in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer token and desktop OAuth refresh token are sent to the attacker's server, enabling account takeover.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 0 – before 2.7.1 |
Weakness: CWE-201 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
References
- GitHub Security Advisory (GHSA-rj93-wmch-2crq) vendor-advisory
- VulnCheck Advisory: Vikunja before 2.7.1 Auth Token Leak via API URL Change third-party-advisory