Cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*

Vikunja versions before 2.6.0 lack rate limiting on public /api/v2 authentication endpoints, enabling credential stuffing, account enumeration, and password-reset flooding.