Vikunja versions 2.2.0 through 2.6.x expose a CORS configuration that blindly accepts any localhost or 127.0.0.1 address as a trusted origin when credentials are included, regardless of the service.publicurl setting. A malicious page served from any localhost port can therefore issue an authenticated request to the token refresh endpoint and read the bearer JWT that is returned. Possession of this token effectively grants full control over the victim’s account.

Vikunja (go‑vikunja:vikunja) is affected. All releases from version 2.2.0 up to, but not including, 2.7.0 contain the flaw. Users deploying these versions on any host should be aware that the default CORS policy permits credentialed requests from localhost origins.

The vulnerability carries a CVSS score of 7.2, indicating high severity. EPSS data is not available and the entry is not listed in the CISA KEV catalog. The likely attack scenario involves an attacker controlling a local web page or script on the same machine as the Vikunja instance; that attacker can then coerce the application to issue credentialed API calls to the token refresh endpoint and obtain a bearer JWT. This process requires no special privileges beyond hosting a page on a local port and does not rely on network connectivity to the public Internet beyond the localhost loopback.