CVE-2026-91982: Vikunja before 2.6.0 TOTP Secret Disclosure via API
Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticator, and generate valid codes indefinitely to defeat the second factor and enable account takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vikunjato a version that resolves this vulnerability.Fixed in 2.6.0 - Compensating control
Ensure access to GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode requires re-authentication so attackers with a valid access token cannot retrieve the raw TOTP shared secret after enrollment.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker needs a valid Vikunja access token for the targeted account. The affected API endpoints expose the enrolled TOTP shared secret without requiring re-authentication.
Which accounts are exposed?
Accounts with TOTP already enrolled on Vikunja versions before 2.6.0 are exposed if an attacker obtains a valid access token for that account. The disclosed secret can be imported into another authenticator to generate valid TOTP codes indefinitely.
How can I determine whether my deployment is affected?
Check the deployed Vikunja version. Versions before 2.6.0 are affected; the relevant endpoints are GET /api/v1/user/settings/totp and GET /api/v1/user/settings/totp/qrcode.