CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-34727

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped. This vulnerability is fixed in 2.3.0.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.0

EPSS Ranking 13.6%

CVSS Severity

CVSS v3 Score 7.4

References

Products affected by CVE-2026-34727

Vikunja » Vikunja » Version: 0.1

cpe:2.3:a:vikunja:vikunja:0.1
Vikunja » Vikunja » Version: 0.10

cpe:2.3:a:vikunja:vikunja:0.10
Vikunja » Vikunja » Version: 0.11

cpe:2.3:a:vikunja:vikunja:0.11
Vikunja » Vikunja » Version: 0.12

cpe:2.3:a:vikunja:vikunja:0.12
Vikunja » Vikunja » Version: 0.13

cpe:2.3:a:vikunja:vikunja:0.13
Vikunja » Vikunja » Version: 0.13.1

cpe:2.3:a:vikunja:vikunja:0.13.1
Vikunja » Vikunja » Version: 0.14.0

cpe:2.3:a:vikunja:vikunja:0.14.0
Vikunja » Vikunja » Version: 0.14.1

cpe:2.3:a:vikunja:vikunja:0.14.1
Vikunja » Vikunja » Version: 0.15.0

cpe:2.3:a:vikunja:vikunja:0.15.0
Vikunja » Vikunja » Version: 0.15.1

cpe:2.3:a:vikunja:vikunja:0.15.1
Vikunja » Vikunja » Version: 0.16.0

cpe:2.3:a:vikunja:vikunja:0.16.0
Vikunja » Vikunja » Version: 0.16.1

cpe:2.3:a:vikunja:vikunja:0.16.1
Vikunja » Vikunja » Version: 0.17.0

cpe:2.3:a:vikunja:vikunja:0.17.0
Vikunja » Vikunja » Version: 0.17.1

cpe:2.3:a:vikunja:vikunja:0.17.1
Vikunja » Vikunja » Version: 0.18.0

cpe:2.3:a:vikunja:vikunja:0.18.0
Vikunja » Vikunja » Version: 0.18.1

cpe:2.3:a:vikunja:vikunja:0.18.1
Vikunja » Vikunja » Version: 0.19.0

cpe:2.3:a:vikunja:vikunja:0.19.0
Vikunja » Vikunja » Version: 0.19.1

cpe:2.3:a:vikunja:vikunja:0.19.1
Vikunja » Vikunja » Version: 0.19.2

cpe:2.3:a:vikunja:vikunja:0.19.2
Vikunja » Vikunja » Version: 0.2

cpe:2.3:a:vikunja:vikunja:0.2
Vikunja » Vikunja » Version: 0.20.0

cpe:2.3:a:vikunja:vikunja:0.20.0
Vikunja » Vikunja » Version: 0.20.1

cpe:2.3:a:vikunja:vikunja:0.20.1
Vikunja » Vikunja » Version: 0.20.2

cpe:2.3:a:vikunja:vikunja:0.20.2
Vikunja » Vikunja » Version: 0.20.3

cpe:2.3:a:vikunja:vikunja:0.20.3
Vikunja » Vikunja » Version: 0.20.4

cpe:2.3:a:vikunja:vikunja:0.20.4
Vikunja » Vikunja » Version: 0.20.5

cpe:2.3:a:vikunja:vikunja:0.20.5
Vikunja » Vikunja » Version: 0.21.0

cpe:2.3:a:vikunja:vikunja:0.21.0
Vikunja » Vikunja » Version: 0.22.0

cpe:2.3:a:vikunja:vikunja:0.22.0
Vikunja » Vikunja » Version: 0.22.1

cpe:2.3:a:vikunja:vikunja:0.22.1
Vikunja » Vikunja » Version: 0.23.0

cpe:2.3:a:vikunja:vikunja:0.23.0
Vikunja » Vikunja » Version: 0.24.0

cpe:2.3:a:vikunja:vikunja:0.24.0
Vikunja » Vikunja » Version: 0.24.1

cpe:2.3:a:vikunja:vikunja:0.24.1
Vikunja » Vikunja » Version: 0.24.2

cpe:2.3:a:vikunja:vikunja:0.24.2
Vikunja » Vikunja » Version: 0.24.3

cpe:2.3:a:vikunja:vikunja:0.24.3
Vikunja » Vikunja » Version: 0.24.4

cpe:2.3:a:vikunja:vikunja:0.24.4
Vikunja » Vikunja » Version: 0.24.5

cpe:2.3:a:vikunja:vikunja:0.24.5
Vikunja » Vikunja » Version: 0.24.6

cpe:2.3:a:vikunja:vikunja:0.24.6
Vikunja » Vikunja » Version: 0.3

cpe:2.3:a:vikunja:vikunja:0.3
Vikunja » Vikunja » Version: 0.4

cpe:2.3:a:vikunja:vikunja:0.4
Vikunja » Vikunja » Version: 0.5

cpe:2.3:a:vikunja:vikunja:0.5
Vikunja » Vikunja » Version: 0.6

cpe:2.3:a:vikunja:vikunja:0.6
Vikunja » Vikunja » Version: 0.7

cpe:2.3:a:vikunja:vikunja:0.7
Vikunja » Vikunja » Version: 0.8

cpe:2.3:a:vikunja:vikunja:0.8
Vikunja » Vikunja » Version: 0.9

cpe:2.3:a:vikunja:vikunja:0.9
Vikunja » Vikunja » Version: 1.0.0

cpe:2.3:a:vikunja:vikunja:1.0.0
Vikunja » Vikunja » Version: 1.1.0

cpe:2.3:a:vikunja:vikunja:1.1.0
Vikunja » Vikunja » Version: 2.0.0

cpe:2.3:a:vikunja:vikunja:2.0.0
Vikunja » Vikunja » Version: 2.1.0

cpe:2.3:a:vikunja:vikunja:2.1.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-34727

Products

Pricing

Contact Us