The vulnerability allows a logged‑in attacker to trick a victim into sending a forged form‑encoded request to the /api/v2 login and OIDC callback endpoints, which the application accepts without checking for CSRF or Origin. This sends the victim’s browser to authenticate with the attacker’s credentials or OIDC code, effectively hijacking the victim’s session. The attacker can then perform actions or add data on behalf of the victim, exposing sensitive information.

Vikunja 2.0.0 through 2.6.x (any release before 2.7.1) is affected. Users running those releases on any platform using the web interface or API are at risk.

The CVSS score of 5.1 indicates a moderate severity. EPSS data is not available and the flaw is not listed in the CISA KEV catalog. The attack vector is cross‑site request forgery from a malicious site that the victim visits. No special privileges are required beyond an existing user account, making the vulnerability exploitable in the wild by gaining a foothold into at least one victim account.