CVE-2026-111917: Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation
Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections to /api/v2/ws after session deletion or TOTP enrollment, continuing to receive the victim's notification.created pushes, including comment, task and project content.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a stolen Vikunja access token for a user. The issue affects WebSocket connections to /api/v2/ws when the token's session has subsequently been deleted or the user has enrolled TOTP.
Does revoking a session or enabling TOTP stop an existing attacker from receiving WebSocket notifications?
No. The affected WebSocket authentication path does not validate the JWT sid claim against the sessions table, so an attacker holding the token can open or maintain WebSocket access after those actions.
What information could remain exposed through the WebSocket connection?
The attacker can continue receiving notification.created pushes, which may include comment, task, and project content.
Which Vikunja versions are affected?
Vikunja versions from 2.3.0 before 2.7.0 are affected.