Brute Force Vulnerability in Vikunja Task Management Platform

CVE-2026-35597

What is CVE-2026-35597?

Vikunja, the open-source self-hosted task management platform, has a vulnerability related to its Time-based One-Time Password (TOTP) implementation. Prior to version 2.3.0, a bug in the database transaction handling mechanism allowed attackers to exploit the failed-attempt lockout feature. When TOTP validation failed, the system was designed to lock a user account after 10 failed attempts. However, due to an unconditional rollback in the database transaction that occurred after each failed attempt, the lockout status was never successfully written to the database. As a result, attackers could continuously attempt to guess the TOTP codes without facing any account lockout, enabling unlimited brute-force attempts. This vulnerability was addressed in version 2.3.0, reinforcing the security of the TOTP authentication process.

References