GHSA-rj93-wmch-2crq: Vikunja before 2.7.1 Auth Token Leak via API URL Change
Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer token and desktop OAuth refresh token are sent to the attacker's server, enabling account takeover.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vikunjato a version that resolves this vulnerability.Fixed in 2.7.1
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker must induce a user to change the frontend API URL to an attacker-controlled server. The vulnerable frontend then sends the user's stored bearer token and desktop OAuth refresh token to that server.
Which credentials can be exposed and what is the impact?
Stored bearer tokens and desktop OAuth refresh tokens can be exposed. An attacker who receives them can take over the affected user's account.
Are deployments on version 2.7.1 affected?
The issue affects Vikunja versions before 2.7.1. Version 2.7.1 is not identified as affected by the provided advisory information.