CVE-2026-123513 Details
Description
Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer token and desktop OAuth refresh token are sent to the attacker's server, enabling account takeover.
A credential exposure vulnerability has been identified in Vikunja versions prior to 2.7.1. This vulnerability allows attackers to steal stored authentication tokens by convincing users to change the frontend API URL to an attacker's server. The issue arises because the function 'checkAndSetApiUrl' does not remove origin-dependent tokens from localStorage, leaving the bearer token and desktop OAuth refresh token intact. As a result, these tokens are sent to the attacker's server, facilitating account takeover.
Users should clear tokens and authentication state whenever the API URL is changed. This can be done by modifying the 'checkAndSetApiUrl' function to include a token clearance step, ensuring that users must log in again when switching API servers.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-201 | Insertion of Sensitive Information Into Sent Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vikunja | <= 2.7.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 8, 2026 | New CVE Received | [email protected] |