{"id":"CVE-2026-123497","title":"Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery","summary":"Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified …","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-319"],"vendor":"go-vikunja","product":"vikunja","affected":["vikunja < 2.7.1"],"published":"2026-11-08","updated":"2026-11-08","sourceUpdated":"2026-11-08T01:37:14.960Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-123497","references":[{"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-wqw2-rgwv-99qx","label":"GitHub Security Advisory (GHSA-wqw2-rgwv-99qx)"},{"url":"https://www.vulncheck.com/advisories/vikunja-veans-before-2.7.1-https-to-http-downgrade-in-server-discovery","label":"VulnCheck Advisory: Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery"}],"tags":["cve.org"],"ingestedAt":"2026-11-08T02:43:18.706Z","slug":"CVE-2026-123497","body":"## Overview\n\nVikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.\n\n## Affected\n\n- `vikunja < 2.7.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}