Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*

2 briefs RSS
high advisory

Vikunja Permissive CORS Policy Leading to Account Compromise

Vikunja versions 2.2.0 through 2.6.0 contain a CORS misconfiguration that implicitly trusts all localhost ports, allowing local attackers to retrieve valid bearer tokens via credentialed cross-origin requests.

Vikunja +3 web-application cors privilege-escalation account-takeover denial-of-service memory-exhaustion migration resource-exhaustion +5
3t
high advisory

Unauthenticated Rate Limiting Vulnerability in Vikunja Authentication Endpoints

Vikunja versions before 2.6.0 lack rate limiting on public /api/v2 authentication endpoints, enabling credential stuffing, account enumeration, and password-reset flooding.

Vikunja
1r 1t 1c