CVE-2026-62367 Details
Description
Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local (username+password) account using only the `email` claim from the IdP. The fallback never checks an `email_verified` (or Microsoft `xms_edov`) signal and never requires the matched account's password. An attacker who can obtain a token from the configured issuer carrying a victim's email logs in as that victim with a full session, with no consent or interaction from the victim. Version 2.4.0 fixes the issue.
A vulnerability in Vikunja versions 1.0.0 through 2.3.0 allows for unauthorized access to local accounts via OpenID Connect (OIDC) email fallback. When an administrator activates the email fallback option for an OIDC provider, Vikunja links the OIDC login to an existing local account based solely on the email claim, without verifying if the email is confirmed or requiring the account's password. This oversight enables an attacker to use a token from the OIDC provider that includes a victim's email to gain access to the victim's account, complete with a full session, and without any interaction from the victim. The vulnerability affects only local accounts, not those created through pure SSO.
Users can update to Vikunja version 2.4.0, which addresses this vulnerability by requiring email verification before linking OIDC accounts to local accounts. Instructions for downloading version 2.4.0 are available on the Vikunja GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-vikunja/vikunja/commit/7854f2729ab72000210b61c25929678fd6901630 | [email protected] | Source CodeVendor |
| https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0 | [email protected] | Release NotesVendor |
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-xv7q-fvmc-jx96 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vikunja | >= 1.0.0, <= 2.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |