GHSA-h4q3-mc9r-q7vv: Vikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpoints

Published Nov 8, 2026

Updated

Vikunja before 2.7.1 contains a missing authentication vulnerability that allows attackers holding a stolen session to enroll and enable TOTP without the account password. Attackers can call the TOTP enroll and enable endpoints with their own secret to lock the owner out, persisting even after password reset.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Vikunja to a version that resolves this vulnerability.
Fixed in 2.7.1

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs a stolen authenticated session for the target Vikunja account. They can then enroll and enable TOTP using a secret they control without providing the account password.

Can resetting the account password remove the attacker's access?

No. The attacker-controlled TOTP enrollment can persist after a password reset, potentially leaving the account owner locked out.

Which deployments are affected?

Vikunja versions before 2.7.1 are affected.

GHSA-h4q3-mc9r-q7vv: Vikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpoints

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Can resetting the account password remove the attacker's access?

Which deployments are affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Can resetting the account password remove the attacker's access?

Which deployments are affected?