Vulnerability in Vikunja Affects User Token Security

CVE-2026-62376

What is CVE-2026-62376?

Vikunja, an open-source self-hosted task management platform, has a vulnerability that allows sensitive user tokens, including those for password resets and account deletions, to be stored in plaintext within the user_tokens table. Should an attacker gain access to the underlying database—whether through insecure backups, misconfigured storage solutions, or SQL injection vulnerabilities—they can exploit these plaintext tokens to compromise user accounts with ease, bypassing password authentication entirely. The issue has been addressed in version 2.4.0 of Vikunja, which implements secure token storage practices.

References