Home / Vulnerability Intelligence / CVE-2026-28268

CVE-2026-28268 - Vulnerability Analysis

CriticalCVSS: 9.8

Last Updated: March 2, 2026

Vikunja - Authentication Bypass

Published: February 27, 2026Updated: March 2, 2026Remote Exploitable

Overview

Vikunja < 2.1.0 contains a broken authentication caused by failure to invalidate password reset tokens in vikunja/api, letting attackers reuse tokens indefinitely for persistent account takeover, exploit requires intercepted reset token.

Severity & Score

Severity: Critical

CVSS Score: 9.8

EPSS Score: 2.9%(Probability of exploitation in next 30 days)

Impact

Attackers can perform persistent account takeover by reusing intercepted password reset tokens indefinitely.

Mitigation

Upgrade to version 2.1.0 or later.

References

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Feb 28, 2026

🔴 CVE-2026-28268 - Critical (9.8) Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28268/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Offensive Sequence

@offseq

Feb 28, 2026

🚨 CRITICAL vuln in go-vikunja vikunja (<2.1.0): Password reset tokens never expire due to logic flaw, enabling persistent account takeover. Patch to v2.1.0+ now! CVE-2026-28268 https://radar.offseq.com/threat/cve-2026-28268-cwe-459-incomplete-cleanup-in-go-vi-0517b158 #OffSeq #Vuln #Security #FOSS

View original post

Related Resources

Details

CVE ID: CVE-2026-28268
Severity: Critical
CVSS Score: 9.8
Type: broken_authentication
Status: unconfirmed
EPSS: 2.9%
Social Posts: 2

CWE

CWE-459

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

2.9%Probability of exploitation in the next 30 days