NIXPKGS-2026-1055

GitHub issue published on

Permalink CVE-2026-34727

7.4 HIGH

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): HIGH
Privileges required (PR): NONE
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): HIGH
Availability impact (A): NONE

updated 2 weeks, 4 days ago by @LeSuisse Activity log

Created suggestion 2 weeks, 4 days ago
@LeSuisse ignored package vikunja-desktop 2 weeks, 4 days ago
@LeSuisse accepted 2 weeks, 4 days ago
@LeSuisse published on GitHub 2 weeks, 4 days ago

Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped. This vulnerability is fixed in 2.3.0.