CVE-2026-123513: Security vulnerability

Published Nov 8, 2026

Updated

Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer token and desktop OAuth refresh token are sent to the attacker's server, enabling account takeover.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Vikunja to a version that resolves this vulnerability.
Fixed in 2.7.1

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Vikunja versions before 2.7.1 are affected. The issue applies where a user can be induced to change the frontend API URL.

What does an attacker need to exploit this issue?

The attacker needs to induce a user to switch the frontend API URL to an attacker-controlled server. The existing bearer token and desktop OAuth refresh token can then be sent to that server.

What is the impact if exploitation succeeds?

An attacker can steal stored authentication tokens, including the bearer token and desktop OAuth refresh token. This can enable takeover of the affected user's account.

CVE-2026-123513: Security vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the impact if exploitation succeeds?