The vulnerable code path would download a user’s avatar image from the URL stored in the OpenID Connect profile picture claim without applying any SSRF safeguards. An attacker who can control that URL can coerce the Vikunja server into sending HTTP requests to any internal or cloud–metadata endpoint, revealing sensitive internal data or enabling further lateral movement. The flaw is a classic SSRF vulnerability (CWE–918) that bypasses protections already enforced for the webhook feature.

The issue affects the Vikunja self‑hosted task management platform, specifically versions prior to 2.2.1. The product is provided by the vendor go‑vikunja under the name Vikunja. All installations that use an OpenID Connect authentication flow for user accounts are potentially impacted, as the avatar download is triggered automatically based on the picture claim.

The CVSS score of 6.4 indicates a moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to register or control an OpenID Connect identity where the picture URL can be set to a malicious endpoint, from which the server will issue the outbound request. Once triggered, the server could reach internal addresses or cloud‑metadata services, but the ability to read or modify data depends on the internal environment and access controls.