Vikunja versions 2.3.0 through 2.6.x contain an improper session validation flaw that allows an attacker with a stolen JWT to maintain a WebSocket connection after the session is revoked. Because the authentication handler does not verify the JWT sid claim against the sessions table, the server continues to accept the token and pushes notification.created events, exposing private comment, task, and project information. This is a case of session authentication invalidated (CWE-613).

Affected systems include the Vikunja to‑do application, vendor go‑vikunja, in releases 2.3.0 up to, but not including, 2.7.0. The product is deployed on environments where WebSocket API /api/v2/ws is enabled, which is true for all official installations of these releases.

The CVSS score of 7.1 indicates high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, but the flaw is still exploitable if an attacker obtains a valid access token. Since the exploitation requires only possession of a JWT, theft or brute‑force of credentials can enable persistence after revocation. The likely attack vector is a hijacked or stolen token used to open or keep a WebSocket connection to /api/v2/ws.