CVE-2026-123495Medium· 4.6▾ SunlitVikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or Origin checks, enabling login cross-site request forgery. An attacker with an account can lure a victim to a page pos…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 25.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or Origin checks, enabling login cross-site request forgery. An attacker with an account can lure a victim to a page posting the attacker's credentials or OIDC code, switching the victim into the attacker's account and exposing data the victim then adds.
vikunja >= 2.0.0 < 2.7.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123494Low· 3.5Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks
CVE-2026-123493Medium· 5.4Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens
CVE-2026-123498Low· 3.7Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata
CVE-2026-123497Medium· 6.8Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery
CVE-2026-123496Low· 3.3Vikunja veans before 2.7.1 Symlink Following in veans init
CVE-2026-123500Medium· 6.2Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump