Authentication Bypass in Vikunja Task Management Platform by Go Vikunja

CVE-2026-33668

What is CVE-2026-33668?

Vikunja, an open-source self-hosted task management platform, is susceptible to an authentication bypass vulnerability. This issue arises when user accounts are disabled or locked; current status checks are limited to local login and JWT token refresh processes. Consequently, users with disabled or locked accounts can still access the API and sync data through three other authentication methods — API tokens, CalDAV basic auth, and OpenID Connect. Version 2.2.1 addresses this vulnerability, ensuring that all authentication paths adequately verify user status.

References