CVE-2026-123495: CSRF

Published Nov 8, 2026

Updated

Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or Origin checks, enabling login cross-site request forgery. An attacker with an account can lure a victim to a page posting the attacker's credentials or OIDC code, switching the victim into the attacker's account and exposing data the victim then adds.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Vikunja to a version that resolves this vulnerability.
Fixed in 2.7.1

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs a Vikunja account and must be able to lure a victim into visiting a page that submits a crafted form to the affected login or OIDC callback endpoint.

What is the impact on a victim?

The victim can be logged into the attacker’s Vikunja account rather than their own. Information the victim subsequently adds while using that account may be exposed to the attacker.

Which deployments are affected?

Vikunja versions from 2.0.0 before 2.7.1 are affected when the /api/v2 login or OIDC callback endpoints accept form-encoded request bodies without CSRF or Origin validation.

CVE-2026-123495: CSRF

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact on a victim?

Which deployments are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact on a victim?

Which deployments are affected?