CVE-2026-91973: Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth
Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's anti-brute-force controls and compromise password-only accounts.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Vikunja instances running a version before 2.6.0 are affected if their CalDAV BasicAuth endpoints are reachable. The identified routes are /dav, /.well-known, and /feeds.
What does an attacker need to exploit it?
An attacker can exploit the issue remotely without authentication or user interaction. They can make unbounded credential-guessing requests to the affected endpoints.
Which accounts are at risk?
Password-only accounts are at risk of compromise through credential guessing. The vulnerability bypasses the instance's anti-brute-force controls for the affected BasicAuth endpoints.
What should be done if the instance cannot immediately be updated?
The provided information identifies the affected routes but does not specify a vendor-supported workaround. Restricting exposure to /dav, /.well-known, and /feeds may reduce access to the vulnerable endpoints until an update to 2.6.0 or later can be applied.