CVE-2026-123497Medium· 6.8▾ SunlitVikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.
vikunja < 2.7.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123494Low· 3.5Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks
CVE-2026-123493Medium· 5.4Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens
CVE-2026-123495Medium· 4.6Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback
CVE-2026-123498Low· 3.7Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata
CVE-2026-123496Low· 3.3Vikunja veans before 2.7.1 Symlink Following in veans init
CVE-2026-123500Medium· 6.2Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump