Description
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped. This vulnerability is fixed in 2.3.0.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| go-vikunja | vikunja | affected |
|
No data.
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-8jvc-mcx6-r4cg | Vikunja has TOTP Two-Factor Authentication Bypass via OIDC Login Path |
References
History
Fri, 10 Apr 2026 16:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped. This vulnerability is fixed in 2.3.0. | |
| Title | Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path | |
| Weaknesses | CWE-287 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-04-10T15:45:30.662Z
Reserved: 2026-03-30T18:41:20.753Z
Link: CVE-2026-34727
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-04-10T16:16:31.853
Modified: 2026-04-10T16:16:31.853
Link: CVE-2026-34727
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses