CVE-2026-28268CWE-459CWE-640

Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse

Critical · published February 27, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
59.7
In the wild
Unconfirmed
What it is

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever. This allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls. Version 2.1.0 contains a patch for the issue.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00914 · 59.7th percentile
Weaknesses
CWE-459 · Incomplete Cleanup; CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
Published
2026-02-27T20:16Z
EPSS history
Timeline
  • 27 FEB 20:16Z
    Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse
    cvelistv5