CVE-2026-91973CWE-307

CVE-2026-91973

High · published September 15, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
51.5
In the wild
Unconfirmed
What it is

Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's anti-brute-force controls and compromise password-only accounts.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00672 · 51.5th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2026-09-15T20:17Z
References (3)
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m469-88xx-8rx2 · [email protected]https://www.vulncheck.com/advisories/vikunja-before-2.6.0-authentication-bypass-via-caldav-basicauth · [email protected]https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m469-88xx-8rx2 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 1%
    epss
  • 15 SEP 15:18Z
    Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth
    cvelistv5