CVE-2026-33473 PUBLISHED

Vikunja has TOTP Reuse During Validity Window

Assigner: GitHub_M
Reserved: 20.03.2026 Published: 24.03.2026 Updated: 24.03.2026

Vikunja is an open-source self-hosted task management platform. Starting in version 0.13 and prior to version 2.2.1, any user that has enabled 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.2.1 patches the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS Score: 5.7

Product Status

Vendor go-vikunja
Product vikunja
Versions
  • Version >= 0.13, < 2.2.1 is affected

References

Problem Types

  • CWE-287: Improper Authentication CWE