Vikunja versions before 2.7.1 allow holders of revoked access tokens to continue authenticating because the SetupTokenMiddleware bypasses session expiration and account-status checks. An attacker who obtains a valid token can, after logging out, resetting a password, or disabling the account, use the /oauth/authorize endpoint or the tk_ API to create new OAuth sessions or API tokens. This leads to persistent unauthorized access and the potential to maintain control over an account long after it has been compromised or revoked. The weakness is a CWE-613 flaw related to authority and permission management.

The vulnerability affects the Vikunja application (go‑vikunja:vikunja). All releases prior to 2.7.1 are impacted; no specific patch versions were listed beyond the threshold of 2.7.1.

The CVSS score of 7.6 indicates a high severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires possession of a valid token, which is commonly obtainable via phishing or session hijacking. Once in possession, an attacker can submit a request to the token endpoint or OAuth authorization flow, creating new authenticated sessions or API tokens without additional verification. The attack vector is clearly through the HTTP token middleware, making the vulnerability straightforward to operate once the token is compromised.