CVE-2026-27575 - Vulnerability Analysis

Overview

Vikunja < 2.0.0 contains a broken authentication caused by weak password enforcement and persistent active sessions after password change, letting attackers maintain access after password reset, exploit requires compromised user account.

Severity & Score

Impact

Attackers can maintain persistent access to user accounts even after password resets, leading to prolonged unauthorized access.

Mitigation

Update to version 2.0.0 or later.

References

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-3ccg-x393-96v8
• https://vikunja.io/changelog/vikunja-v2.0.0-was-released

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 26, 2026

🔴 CVE-2026-27575 - Critical (9.1) Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 1234, password) without enforcing minimum strength requirements. Additionally, active sessions remain... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27575/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner