CVE-2026-91972: Vikunja before 2.6.0 Authentication Bypass via Unthrottled API
Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote unauthenticated attackers can perform unbounded credential guessing, account enumeration, and password-reset flooding attacks without throttling restrictions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vikunjato a version that resolves this vulnerability.Fixed in 2.6.0 - Configuration
Ensure Vikunja applies rate limiting to the /api/v2 public authentication endpoints: login, register, password-reset, and OAuth token routes (affected in versions before 2.6.0 where rate limiting is not applied).
Vikunja API (public authentication endpoints) Rate limiting (throttling) = enabled for /api/v2 login, register, password-reset, and OAuth token routes
Event History
Frequently Asked Questions
Which deployments are affected?
Vikunja versions before 2.6.0 are affected if they expose the /api/v2 public authentication endpoints, including login, registration, password-reset, or OAuth token routes.
What does an attacker need to exploit this issue?
An attacker only needs network access to the affected public API endpoints. No account, credentials, or user interaction is required.
What attacks become practical without rate limiting?
An attacker can make unlimited credential-guessing attempts, enumerate accounts, or flood password-reset functionality because the affected routes are not throttled.
What should be done if an immediate upgrade is not possible?
The provided information identifies the missing control as rate limiting on public /api/v2 authentication routes. Apply throttling protections to the login, registration, password-reset, and OAuth token endpoints until upgrading to 2.6.0 or later.