GHSA-4qvp-948j-4cgv: Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware
Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account disabling, mint OAuth sessions via /oauth/authorize or tk API tokens for persistent access.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vikunjato a version that resolves this vulnerability.Fixed in 2.7.1
Event History
Frequently Asked Questions
Which deployments are affected?
Vikunja versions before 2.7.1 are affected. Users are at risk when an attacker has obtained an access token that was later revoked or should otherwise no longer be valid.
What does an attacker need to exploit this issue?
The attacker needs a stolen access token. The token can continue to authenticate even after the legitimate user logs out, resets their password, or has their account disabled.
What persistence can a token holder obtain?
A holder of a revoked token can mint OAuth sessions through /oauth/authorize or create tk_ API tokens, allowing continued access after the original token should have been invalidated.