Vikunja allows a two‑factor authentication code to be reused within the normal thirty‑second validity period. An attacker who obtains or predicts a valid TOTP can replay it until it expires, gaining access to the victim’s account without needing the previous code. This flaw is a Classic Authentication Bypass weakness (CWE‑287) and can expose all data protected by the user’s account.

The vulnerability affects all hosted Vikunja installations running versions from 0.13 up to, but excluding, 2.2.1. That range includes the 2.2.0 release and earlier branches. Users who have enabled 2FA on these versions are exposed.

The CVSS score of 5.7 indicates moderate severity. The EPSS probability is below 1 %, and the flaw is not listed in CISA’s KEV catalog, suggesting limited widespread exploitation to date. The likely attack vector is remote, requiring an attacker to obtain a valid TOTP for a target account or to compromise an existing session. If achieved, the attacker can reuse the code until the next sixty‑second window ends, allowing continued access for several minutes.