CVE-2026-123513Medium· 6.8▾ SunlitVikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer token and desktop OAuth refresh token are sent to the attacker's server, enabling account takeover.
vikunja < 2.7.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123494Low· 3.5Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks
CVE-2026-123493Medium· 5.4Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens
CVE-2026-123495Medium· 4.6Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback
CVE-2026-123498Low· 3.7Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata
CVE-2026-123497Medium· 6.8Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery
CVE-2026-123496Low· 3.3Vikunja veans before 2.7.1 Symlink Following in veans init