Improper Session Validation in Vikunja Affects WebSocket Security

CVE-2026-111917

What is CVE-2026-111917?

Vikunja versions 2.3.0 through 2.6.0 exhibit an improper session validation flaw that compromises WebSocket security. Specifically, the vulnerability allows attackers to retain WebSocket access even after their session has been revoked. This occurs because the handleAuth function fails to validate the JWT sid claim against the sessions database. As a result, an attacker with a compromised access token can continue to establish or maintain WebSocket connections to /api/v2/ws after their session has been deleted or after two-factor authentication (TOTP) enrollment. This enables unauthorized access to critical notifications, including comments, tasks, and project content, posing a significant risk to user data integrity and security.

References