CVE-2026-33473CWE-287

Vikunja has TOTP Reuse During Validity Window

Medium · published March 24, 2026

CVSS v3.1
5.7
EPSS
0%
Percentile
31.7
In the wild
Unconfirmed
What it is

Vikunja is an open-source self-hosted task management platform. Starting in version 0.13 and prior to version 2.2.1, any user that has enabled 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.2.1 patches the issue.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00388 · 31.7th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-03-24T15:18Z
EPSS history
Timeline
  • 24 MAR 15:18Z
    Vikunja has TOTP Reuse During Validity Window
    cvelistv5