Insufficient Session Expiration in Vikunja Affected by Security Flaw

CVE-2026-123528

What is CVE-2026-123528?

Vikunja prior to version 2.7.1 is vulnerable to an insufficient session expiration issue. This flaw allows users holding revoked access tokens to maintain authentication, as the SetupTokenMiddleware circumvent session and account-status validations. An attacker with a stolen token may exploit this vulnerability to create persistent OAuth sessions, even after the user has logged out, reset their password, or had their account disabled, thereby compromising account security and access control.

References