CVE-2026-123530

CVSS 6.0 (medium) · published 2026-11-08

Vikunja before 2.7.1 contains a missing authentication vulnerability that allows attackers holding a stolen session to enroll and enable TOTP without the account password. Attackers can call the TOTP enroll and enable endpoints with their own secret to lock the owner out, persisting even after password reset.

Weakness: CWE-306

Source: NVD CVE-2026-123530

References

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-h4q3-mc9r-q7vv
• https://www.vulncheck.com/advisories/vikunja-before-2.7.1-missing-step-up-authentication-via-totp-enrollment-endpoints

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.