CVE-2026-91982CWE-522

CVE-2026-91982

Medium · published September 15, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
26.9
In the wild
Unconfirmed
What it is

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticator, and generate valid codes indefinitely to defeat the second factor and enable account takeover.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00346 · 26.9th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2026-09-15T20:17Z
References (3)
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-88f6-4rjv-x774 · [email protected]https://www.vulncheck.com/advisories/vikunja-before-2.6.0-totp-secret-disclosure-via-api · [email protected]https://github.com/go-vikunja/vikunja/security/advisories/GHSA-88f6-4rjv-x774 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 15 SEP 15:18Z
    Vikunja before 2.6.0 TOTP Secret Disclosure via API
    cvelistv5