Vikunja, an open‑source task management platform, has a flaw in its OIDC callback handling where a full JWT token is issued without verifying that the user has TOTP two‑factor authentication enabled. Consequently, a local user who has enrolled TOTP can be matched through the OIDC email fallback and gain access without completing the second factor. This bypass effectively undermines the intended two‑factor protection and maps to CWE‑287, which deals with authentication bypass by credential manipulation.

The vulnerability exists in Vikunja releases older than version 2.3.0. Users running these earlier releases are at risk; the issue is resolved in version 2.3.0 and later.

The CVSS score of 7.4 denotes a high severity, indicating that an attacker can fully compromise the authentication process. The vulnerability is exploitable remotely via the OIDC login path, without needing any additional privileges. Although EPSS data is unavailable and the flaw is not listed in the CISA KEV catalog, the ability to bypass two‑factor authentication presents a critical threat to identity integrity and confidentiality.