Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123528Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware
Medium 6.8
In plain English
A medium-severity security flaw in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account disabling, mint OAuth sessions via /oauth/authorize or tk_ API tokens for persistent access.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 0 – before 2.7.1 |
Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- GitHub Security Advisory (GHSA-4qvp-948j-4cgv) vendor-advisory
- VulnCheck Advisory: Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware third-party-advisory