HIGH 7.6 NVD
CVE-2026-123528
Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because Setup
Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account disabling, mint OAuth sessions via /oauth/authorize or tk_ API tokens for persistent access.
References
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-4qvp-948j-4cgv
- https://www.vulncheck.com/advisories/vikunja-before-2.7.1-insufficient-session-expiration-
This high severity vulnerability with a CVSS score of 7.6 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.