CVE-2026-34727CWE-287

Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path

High · published April 10, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
35.0
In the wild
Unconfirmed
What it is

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped. This vulnerability is fixed in 2.3.0.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00417 · 35.0th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-04-10T15:45Z
EPSS history
Timeline
  • 10 APR 15:45Z
    Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path
    cvelistv5