CVE-2026-111917 Details
Description
Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections to /api/v2/ws after session deletion or TOTP enrollment, continuing to receive the victim's notification.created pushes, including comment, task and project content.
A vulnerability in Vikunja versions 2.3.0 prior to 2.7.0 allows for improper session validation, enabling attackers to retain WebSocket access after a session has been revoked. This issue arises because the authentication handler does not verify the JWT session ID claim against the server-side sessions table. As a result, an attacker with a stolen access token can open or maintain connections to the WebSocket API after their session has been deleted or after enrolling in TOTP, which is supposed to invalidate all sessions. This exploitation allows the attacker to continue receiving real-time notifications intended for the victim, including comments, tasks, and project details.
Users can update to Vikunja version 2.7.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 17, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-4hv6-xc92-j86g | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-4hv6-xc92-j86g | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/vikunja-2.3.0-before-2.7.0-websocket-authentication-ignores-session-revocation | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vikunja | >= 2.3.0, <= 2.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2026 | New CVE Received | [email protected] |