CVE-2026-123497: Security vulnerability

Published Nov 8, 2026

Updated

Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this vulnerability?

Users of Vikunja veans versions before 2.7.1 are exposed when initializing or logging in over a network where an attacker can act on-path and interfere with HTTPS connectivity.

What must an attacker be able to do to exploit it?

The attacker must be positioned to intercept or manipulate the victim's network traffic and block HTTPS ports. They can then cause server discovery to accept an unverified HTTP response.

What information could be compromised?

An attacker may capture passwords, TOTP codes, or bot tokens during initialization or login. The downgrade can also cause subsequent API traffic to persist in cleartext.

How can we determine whether we are affected?

Verify the installed Vikunja veans version. Versions before 2.7.1 are affected by the described downgrade behavior.

CVE-2026-123497: Security vulnerability

Event History

Frequently Asked Questions

Who is exposed to this vulnerability?

What must an attacker be able to do to exploit it?

What information could be compromised?

How can we determine whether we are affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

What must an attacker be able to do to exploit it?

What information could be compromised?

How can we determine whether we are affected?