CVE-2026-123497 Details
Description
Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.
A protocol downgrade vulnerability has been identified in Vikunja Veans versions prior to 2.7.1. This vulnerability allows on-path attackers to intercept and force the use of plain HTTP during the initialization and login processes. By blocking HTTPS ports, attackers can manipulate the discovery process to accept an unverified HTTP response, thereby capturing sensitive information such as passwords, TOTP codes, or bot tokens. Additionally, this exploitation leads to the persistence of cleartext API traffic.
Users are advised to update to Vikunja Veans version 2.7.1 or later. The vulnerability can also be mitigated by ensuring that HTTP is only tried for loopback hosts or user-typed 'http://' URLs, and not as a fallback for 'https://' or bare hostnames.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-319 | Cleartext Transmission of Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vikunja veans | <= 0.0.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 8, 2026 | New CVE Received | [email protected] |