Vikunja, an open‑source self‑hosted task management platform, has a business logic flaw that allows password reset tokens to be reused indefinitely. The system fails to invalidate used tokens and the cleanup cron job never removes them, so once a token is issued it remains valid forever. An attacker who obtains any single reset token—by reading server logs, inspecting browser history, or phishing—can later use that token at any time to log in as the designated user. This results in complete, persistent account takeover and bypasses all standard authentication controls.

All installations of Vikunja before version 2.1.0 are affected. The issue was fixed in release 2.1.0, so any instance still running an older version is at risk.

The CVSS score of 9.8 reflects a severe impact. The EPSS score of less than 1% indicates a currently low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is the password reset flow, requiring only possession of a valid token—a token that can be extracted from logs, browser history, or through phishing. Once in possession of such a token, the attacker can complete the takeover at any future point, highlighting a high exploitation potential if the token is compromised.