CVE-2026-91972

Vikunja before 2.6.0 Authentication Bypass via Unthrottled API

View on CVE.org
Published Sep 15, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Description
Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote unauthenticated attackers can perform unbounded credential guessing, account enumeration, and password-reset flooding attacks without throttling restrictions.

Analysis

AI-generated

Technical impact

Vikunja versions prior to 2.6.0 fail to enforce rate limiting on public authentication API endpoints such as login, registration, password‑reset, and OAuth token routes. This flaw allows attackers who do not need to authenticate to perform unbounded credential guessing, enumerate accounts, and flood password‑reset requests, potentially compromising accounts and disrupting legitimate password‑reset services.

Affected Systems

The vulnerability affects versions of Vikunja that are prior to 2.6.0, a free and open‑source task‑management platform provided by go‑vikunja.

Risk and Exploitability

With a CVSS score of 8.7 the vulnerability is considered high severity. The EPSS score of <1% indicates a low likelihood of exploitation in the wild, and it is not listed in the CISA KEV catalog. Attackers can exploit the lack of throttling from anywhere on the internet, without needing initial access, making the flaw an unauthenticated remote vulnerability that can lead to account compromise.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Vikunja to version 2.6.0 or later.
  • If an immediate upgrade is not possible, configure network or application firewall rules to rate‑limit requests to the authentication API endpoints.
  • Restrict access to the authentication endpoints to trusted IP addresses or enforce multi‑factor authentication where feasible.

Generated by OpenCVE AI on September 20, 2026 at 16:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-6rvj-qwjf-3m4q Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Go-vikunja
Go-vikunja vikunja
Vendors & Products Go-vikunja
Go-vikunja vikunja
Type Values Removed Values Added
Description Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote unauthenticated attackers can perform unbounded credential guessing, account enumeration, and password-reset flooding attacks without throttling restrictions.
Title Vikunja before 2.6.0 Authentication Bypass via Unthrottled API
First Time appeared Vikunja
Vikunja vikunja
Weaknesses CWE-307
CPEs cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*
Vendors & Products Vikunja
Vikunja vikunja
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-307

    Improper Restriction of Excessive Authentication Attempts

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Sep 17, 2026, 3:12 PM
Reserved
Sep 15, 2026, 11:09 AM

View source JSON

Updated
Sep 17, 2026, 3:12 PM

JSON

Status
Deferred
Published
Sep 15, 2026, 4:17 PM
Modified
Sep 17, 2026, 4:18 PM

View source JSON

No data.

Updated
Sep 20, 2026, 4:30 PM

JSON