Attack Chain

1. The attacker identifies a Vikunja instance with OIDC enabled and EmailFallback set to true.
2. The attacker identifies a valid local user with TOTP enabled and determines the user's email address.
3. The attacker creates or compromises an account on the configured OIDC provider that uses the same email address as the target Vikunja user.
4. The attacker initiates the OIDC login flow to the Vikunja instance.
5. The OIDC provider authenticates the attacker using their compromised or created account.
6. Vikunja's OIDC callback handler (pkg/modules/auth/openid/openid.go) matches the email address from the OIDC provider to the local user.
7. The callback handler incorrectly issues a JWT without performing TOTP verification, bypassing the second factor.
8. The attacker uses the received JWT to authenticate to the Vikunja API and gains full access to the user's account.

Impact

Successful exploitation allows an attacker to bypass TOTP two-factor authentication and gain unauthorized access to Vikunja accounts. This can lead to data breaches, modification of tasks and projects, and potential further compromise of the Vikunja instance. Any user who has enrolled TOTP on their local account can have that protection completely bypassed if their email address is also present in the OIDC provider. This undermines the security of TOTP enrollment.

Recommendation

• Apply the recommended fix by adding a TOTP check in the OIDC callback before issuing the JWT, as described in the advisory.
• Disable the EmailFallback option in the Vikunja OIDC configuration until the patch is applied.
• Monitor Vikunja logs for unusual OIDC login activity, specifically successful OIDC logins for users who also have local accounts with TOTP enabled.
• Deploy the Sigma rule Detect Vikunja Successful OIDC Login Bypassing TOTP to identify successful logins that bypass TOTP.
• Deploy the Sigma rule Detect Vikunja OIDC Callback Request to identify potential OIDC login attempts.