CVE-2026-123528 Details

A vulnerability exists in Vikunja versions prior to 2.7.1, where the session expiration mechanism is inadequate. This flaw allows users with revoked access tokens to continue authenticating, as the SetupTokenMiddleware bypasses essential session and account-status verifications. Consequently, an attacker with a stolen token can, after the user logs out, resets their password, or has their account disabled, generate new OAuth sessions or tk_ API tokens for ongoing access. The issue arises because the HTTP authentication process only checks the token's signature and expiration, neglecting to confirm the validity of the associated session or account status. In contrast, WebSocket connections do perform this check, leading to inconsistent protection.

Users should update to Vikunja version 2.7.1 or later, where this vulnerability has been addressed.