Unauthenticated Rate Limiting Vulnerability in Vikunja Authentication Endpoints

Vikunja versions prior to 2.6.0 contain a critical vulnerability in the handling of public API requests. The platform fails to apply rate limiting or throttling mechanisms to key /api/v2 authentication endpoints, including those responsible for user login, registration, password resets, and OAuth token exchanges. This architectural oversight allows remote, unauthenticated attackers to perform unbounded high-volume requests against these services. The absence of defensive controls such as IP-based throttling or request rate limiting facilitates automated brute-force attacks, large-scale account enumeration, and denial-of-service scenarios via password-reset flooding. Given the exposure of these endpoints to the public internet, defenders should prioritize upgrading to version 2.6.0 or implementing external rate-limiting controls at the web application firewall (WAF) or reverse proxy level to mitigate potential exploitation.

Impact

The vulnerability poses a significant risk to user account integrity and system availability. Success in exploiting this flaw enables attackers to compromise user accounts through credential stuffing, map user existence within the application through account enumeration, and disrupt user access by flooding the password-reset infrastructure. Organizations hosting Vikunja are susceptible to automated malicious traffic that can bypass basic security protections, potentially leading to widespread account takeovers.

Recommendation

1. Upgrade all instances of Vikunja to version 2.6.0 or later immediately to apply the required rate-limiting patches.
2. Deploy WAF rules or reverse proxy rate-limiting configurations for the /api/v2 endpoint path to block high-frequency requests originating from single IP addresses or identified automated agents.
3. Monitor web server logs for anomalous spikes in POST requests to /api/v2/login, /api/v2/register, and /api/v2/password-reset.