Authentication Bypass Vulnerability in Vikunja by Go Vikunja

CVE-2026-91973

What is CVE-2026-91973?

Vikunja prior to version 2.6.0 contains a vulnerability that allows unauthenticated remote attackers to bypass authentication controls in CalDAV BasicAuth endpoints. These endpoints lack adequate rate limiting, enabling attackers to execute unlimited credential-guessing requests against specific routes such as /dav, /.well-known, and /feeds. As a result, this vulnerability can potentially lead to compromised password-only accounts due to the ineffective brute-force mitigation mechanisms in place.

References