The vulnerability arises from a weak password policy that allows easily guessable passwords such as 1234 or password, coupled with persistent sessions that remain logged in even after a user changes their password. An attacker who compromises an account through brute‑force or credential‑stuffing attacks can retain unauthorized access after the legitimate user resets their password, effectively bypassing the intended security boundary. Because the system does not enforce a minimum password strength, any user can fall into this scenario, making the impact a persistent unauthenticated or unauthorized session.

This issue affects the open‑source self‑hosted task management platform Vikunja from the vendor go‑vikunja:vikunja, namely all releases older than version 2.0.0. Version 2.0.0 and later incorporate the fix that enforces stronger password requirements and invalidates sessions when the password is updated.

The vulnerability carries a CVSS score of 9.1, indicating a high‑severity risk. The EPSS score is less than 1% at the time of analysis, implying a low but non‑zero probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring access to the web application’s authentication endpoint; once a valid account is compromised, the attacker benefits from persistent sessions that survive password changes. Because the attacker’s session does not expire, the vulnerability can be abused to maintain covert malicious presence, making it difficult to detect or mitigate without intervention.