TOTP Secret Disclosure in Vikunja by Vikunja

CVE-2026-91982

What is CVE-2026-91982?

Prior to version 2.6.0, Vikunja's API endpoints /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode mistakenly expose the raw TOTP shared secret following the enrollment process. This occurs without requiring any re-authentication, allowing attackers with valid access tokens to read the secret. With this information, an attacker can import the TOTP secret into an authenticator app, generate valid authentication codes indefinitely, and potentially execute account takeovers by circumventing the second factor of authentication.

References