Vikunja before update 2.7.1 contains a credential exposure flaw that lets an attacker obtain a user’s stored authentication tokens. By tricking a target into changing the frontend API URL to a domain controlled by the attacker, the application continues to send origin‑independent tokens stored in localStorage to the new endpoint. The attacker receives the bearer token and the desktop OAuth refresh token, achieving account takeover. The weakness is an instance of improper handling of authentication credentials (CWE‑201).

The flaw affects the open source task‑management application Vikunja, specifically versions earlier than 2.7.1. The product is distributed under the open source license and the issue is relevant for all installations that allow users to modify the API URL through the web interface. The CNA identifiers indicate the vendor "go‑vikunja" and the product "vikunja".

The CVSS score of 7.6 denotes high severity. No EPSS score is available, so the exploit probability is undetermined; the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is indirect and user‑initiated, with the attacker sending a link that causes the victim to change the API URL to a malicious domain. If an authenticated user follows the link, the stolen credentials will enable full account takeover. Monitoring for unusual API URL changes and restricting the feature are therefore warranted until the official patch is applied.