CVE-2026-34727 PUBLISHED

Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path

Assigner: GitHub_M
Reserved: 30.03.2026 Published: 10.04.2026 Updated: 10.04.2026

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped. This vulnerability is fixed in 2.3.0.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 7.4

Product Status

Vendor go-vikunja
Product vikunja
Versions
  • Version < 2.3.0 is affected

References

Problem Types

  • CWE-287: Improper Authentication CWE