Vikunja versions before 2.7.1 lack proper throttling for authentication attempts, letting a session holder repeatedly call the /user/settings/totp/disable endpoint without any rate limit. An attacker who has compromised or stolen a user session can use this unthrottled path to guess the user’s password and disable TOTP without providing the one‑time code, resulting in a persistent takeover of the user account.

The vulnerability affects the Vikunja project’s web application (go‑vikunja:vikunja). All releases prior to 2.7.1 are vulnerable; only versions 2.7.1 and newer contain the mitigation.

The CVSS base score is 6, indicating moderate severity, and the vulnerability is not listed in CISA’s KEV catalog. Because a stolen session is required, the attack vector is opportunistic and depends on prior session hijacking; however, once a session is in place, the lack of throttling provides a low‑effort brute‑force path with no lockout mechanism, making exploitation likely if an attacker can subvert a user’s session cookie. The EPSS score is not available, so the exploitation probability cannot be quantified precisely, but the presence of unrestrained password guessing markedly elevates risk.