---
id: CVE-2026-123497
title: Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery
summary: >-
  Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in
  serverCandidates that allows on-path attackers to force plain HTTP during
  veans init and login. Attackers can block HTTPS ports so discovery accepts an
  unverified …
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-319
vendor: go-vikunja
product: vikunja
affected:
  - vikunja < 2.7.1
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T01:37:14.960Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123497'
references:
  - url: >-
      https://github.com/go-vikunja/vikunja/security/advisories/GHSA-wqw2-rgwv-99qx
    label: GitHub Security Advisory (GHSA-wqw2-rgwv-99qx)
  - url: >-
      https://www.vulncheck.com/advisories/vikunja-veans-before-2.7.1-https-to-http-downgrade-in-server-discovery
    label: >-
      VulnCheck Advisory: Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in
      Server Discovery
tags:
  - cve.org
ingestedAt: '2026-11-08T02:43:18.706Z'
---

## Overview

Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.

## Affected

- `vikunja < 2.7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.