CVE-2026-123521: Security vulnerability

Published Nov 8, 2026

Updated

Vikunja before 2.7.1 contains an improper restriction of excessive authentication attempts vulnerability that allows session holders to brute-force account passwords via unthrottled re-authentication endpoints. Attackers with a stolen session can guess the password via /user/settings/totp/disable without lockout, then disable TOTP without a code for persistent account takeover.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Vikunja to a version that resolves this vulnerability.
Fixed in 2.7.1

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Vikunja deployments running versions before 2.7.1 are affected. Exploitation requires an attacker to already possess a valid user session.

What does an attacker need to do to take over an account?

Using a stolen session, the attacker can make unthrottled password guesses through the re-authentication flow at /user/settings/totp/disable. After determining the password, they can disable TOTP without providing a TOTP code, enabling persistent account takeover.

Does this vulnerability require the attacker to know the account password first?

No. The affected endpoint permits password brute-forcing without lockout when the attacker has a stolen session, allowing them to guess the password before disabling TOTP.

CVE-2026-123521: Security vulnerability

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to take over an account?

Does this vulnerability require the attacker to know the account password first?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to take over an account?

Does this vulnerability require the attacker to know the account password first?