Skip to content
Threat Feed
Subscribe

Tag

Cve-2026-34727

1 brief RSS
high advisory

Vikunja TOTP Two-Factor Authentication Bypass via OIDC Login

Vikunja version 2.2.2 and earlier has a two-factor authentication bypass vulnerability via the OIDC login path, where TOTP enrollment is ignored when a local user with TOTP enabled is matched via OIDC email fallback, allowing attackers with a matching email address in the OIDC provider to gain access without the second factor.

Vikunja totp oidc bypass cve-2026-34727
2r 1t 3i