The vulnerability in Vikunja enables an unauthenticated attacker to bypass the application’s built‑in rate limit by sending spoofed X-Forwarded-For or X-Real-IP headers. The rate‑limiting logic mistakenly trusts these headers as the client IP, allowing the attacker to issue an unlimited number of requests. This flaw can be exploited to perform brute‑force scans of usernames or passwords, and to overload the server with excessive traffic. The weakness is a classic example of unvalidated user input that leads to uncontrolled request handling.

All Vikunja installations from version 0.8 up through the patch release 2.1.x are affected. The vendor is Vikunja, an open‑source self‑hosted task management platform. The vulnerable component is the rate‑limit middleware that relies on the echo.Context RealIP field to enforce request quotas.

With a CVSS score of 5.3, the issue is classified as medium severity, and the EPSS score is below 1%, indicating a low likelihood of active exploitation. It is not included in the CISA KEV catalog. The attack vector is remote and requires no authentication; the attacker merely crafts HTTP requests with spoofed IP headers. If the application is exposed to the Internet, this can lead to denial‑of‑service or credential‑guessing attacks.