PT-2026-22393 · Vikunja · Vikunja
Vashuvats
·
Published
2026-02-27
·
Updated
2026-03-25
·
CVE-2026-28268
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Vikunja versions prior to 2.1.0
Description
Vikunja, an open-source self-hosted task management platform, has a business logic flaw in its password reset mechanism within the
vikunja/api. This allows password reset tokens to be reused indefinitely. The issue arises from a failure to invalidate tokens after use and a logic error in the token cleanup cron job, which prevents the removal of expired tokens. An attacker intercepting a single reset token can perform a persistent account takeover, bypassing standard authentication. The vulnerability stems from two distinct logic errors: the ResetPassword function incorrectly deletes TokenEmailConfirm tokens instead of TokenPasswordReset tokens, and the token cleanup cron job deletes new tokens instead of old ones. This results in an infinite attack window, allowing exploitation long after the token was initially issued.Recommendations
Update to version 2.1.0.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Vikunja