Vikunja veans before 2.7.1 contains a protocol downgrade flaw in the serverCandidates component that allows an on‑path adversary to force the service to fall back from HTTPS to plain HTTP during initialization and login. This vulnerability exploitable via CWE‑319 lets attackers spoof a TLS‑secure connection and capture credentials such as passwords, TOTP codes, and bot tokens, as well as any API traffic sent in clear text.

The affected product is Vikunja (maintained by go‑vikunja) running version 2.7.0 or earlier. Versions starting with 2.7.1 include the fix.

The CVSS base score is 7.6, indicating a high‑severity vulnerability with a potential for credential compromise. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, yet an on‑path attacker can exploit the downgrade without needing privileged access. If the service is reachable from an attacker’s network segment, they can block HTTPS ports so the discovery process accepts the unverified HTTP response, enabling interception of authentication data and persistent clear‑text API traffic. Given the ease of exploiting the downgrade, the risk to confidentiality is significant and the likelihood of exploitation remains high in environments with exposed network paths.