Open-Source Task Management Platform Vulnerability in Vikunja
CVE-2026-34727

7.4HIGH

Key Information:

Vendor

Go-vikunja

Status
Vikunja
Vendor
CVE Published:
10 April 2026

What is CVE-2026-34727?

Vikunja, an open-source self-hosted task management platform, has a security flaw in its OpenID Connect (OIDC) callback handler. Specifically, before version 2.3.0, the system issued a complete JSON Web Token (JWT) without verifying if the user matched has enabled Time-Based One-Time Password (TOTP) two-factor authentication. This can lead to situations where a local user who has TOTP configured may bypass the additional authentication step entirely via the OIDC email fallback mechanism, posing significant security risks. The issue has been rectified in version 2.3.0.

Affected Version(s)

vikunja < 2.3.0

References

https://github.com/go-vikunja/vikunja/security/advisories...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.