CVE-2026-28268 - Vulnerability Analysis

Overview

Vikunja < 2.1.0 contains a broken authentication caused by failure to invalidate password reset tokens in vikunja/api, letting attackers reuse tokens indefinitely for persistent account takeover, exploit requires intercepted reset token.

Severity & Score

Impact

Attackers can perform persistent account takeover by reusing intercepted password reset tokens indefinitely.

Mitigation

Upgrade to version 2.1.0 or later.

References

• https://github.com/go-vikunja/vikunja/commit/5c2195f9fca9ad208477e865e6009c37889f87b2
• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rfjg-6m84-crj2
• https://vikunja.io/changelog/vikunja-v2.1.0-was-released

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner