CVE-2026-27575 - Vulnerability Analysis

Overview

Vikunja < 2.0.0 contains a broken authentication caused by weak password enforcement and persistent active sessions after password change, letting attackers maintain access after password reset, exploit requires compromised user account.

Severity & Score

Impact

Attackers can maintain persistent access to user accounts even after password resets, leading to prolonged unauthorized access.

Mitigation

Update to version 2.0.0 or later.

References

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-3ccg-x393-96v8
• https://vikunja.io/changelog/vikunja-v2.0.0-was-released

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner