An in‑memory counter records TOTP failures, but the lockout state is not persisted because a database rollback undoes the status change. When an attacker supplies an incorrect TOTP code, the account never locks, allowing unlimited attempts to guess a correct code. This flaw permits brute‑force authentication of two‑factor protected accounts. The weakness is captured by CWE‑307 and results in elevated access without valid second factor, leading to potential unauthorized data exposure and modification.

The issue affects the Vikunja task‑management platform, provided by the go‑vikunja organization. Any deployment of Vikunja version 2.2.x or earlier is vulnerable. The problem is resolved in release 2.3.0 and later. Users running earlier versions on external servers or internal infrastructure are at risk.

The CVSS base score of 5.9 indicates moderate severity. No EPSS information is available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw operates during the login phase, it can be exploited over the network when an attacker can supply a username and repeated TOTP attempts, or locally if the attacker can guess a valid username. The attack vector is therefore likely remote network login or local compromise, and an attacker can gain access after sufficient failed TOTP attempts because the lockout never persists.