Skip to content
Threat Feed
Subscribe

Product

Vikunja (<= 2.3.0)

1 brief RSS
high advisory

Vikunja Permissive CORS Policy Leading to Account Compromise

Vikunja versions 2.2.0 through 2.6.0 contain a CORS misconfiguration that implicitly trusts all localhost ports, allowing local attackers to retrieve valid bearer tokens via credentialed cross-origin requests.

Vikunja +3 web-application cors privilege-escalation account-takeover denial-of-service memory-exhaustion migration resource-exhaustion +5
3t