Vikunja veans before version 2.7.1 carries a credential exposure flaw that allows an attacker who controls a repository to capture API tokens and authentication secrets. The vulnerable component reads the VEANS_TOKEN and other sensitive tokens from the environment and transmits them as Bearer tokens or plaintext credentials to an attacker‑specified server defined in the repository’s .veans.yml file. If leveraged, an adversary can obtain complete Vikunja access for the victim user, leading to unauthorized data access and potential lateral movement within the organization.

The issue affects the Vikunja application (go‑vikunja:vikunja). Any deployment using versions older than 2.7.1 is susceptible. The vulnerability manifests when the veans tool runs against a checkout that is not fully trusted, such as a public or shared repository, as the attacker authoring the .veans.yml file controls the server endpoint to which tokens are sent.

The vulnerability has a CVSS score of 6.0, indicating a medium severity risk. No EPSS score is published, and the issue is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely remote; a malicious repository author can embed a malicious server URL in .veans.yml, and anyone checking out the repository triggers the credential exfiltration. The attacker requires prior access to the repository to craft the malicious configuration but does not need additional privileges within the target environment to capture the victim’s tokens.