CVE-2026-123497
Deferred Deferred - Pending Action

Protocol Downgrade in Vikunja Veans

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123497
EUVD
EUVD-2026-119382

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vikunja veans to 2.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a protocol downgrade flaw in Vikunja veans versions before 2.7.1. It allows attackers on the network path to force the use of plain HTTP instead of HTTPS during server discovery and login. By blocking HTTPS ports, attackers can trick the application into accepting an unverified HTTP response, exposing sensitive data like passwords, TOTP codes, or bot tokens. This also enables persistent interception of cleartext API traffic.

Detection Guidance

Monitor network traffic for unexpected HTTP connections during Vikunja initialization or login. Check logs for plain HTTP API calls when HTTPS should be used. Inspect saved server URLs in client configurations for HTTP endpoints.

Impact Analysis

If you use Vikunja veans before 2.7.1, attackers could capture your login credentials, one-time passwords, or API tokens. This could lead to unauthorized access to your account, data theft, or further attacks using your credentials. The vulnerability also allows persistent monitoring of your unencrypted API traffic.

Compliance Impact

This vulnerability likely violates compliance requirements for encrypted data transmission, such as GDPR's data protection principles or HIPAA's security rules. Exposure of credentials or sensitive data in cleartext could result in regulatory penalties due to non-compliance with data protection standards.

Mitigation Strategies

Upgrade Vikunja to version 2.7.1 or later. Block HTTP traffic in firewall rules for Vikunja services. Configure clients to only use HTTPS endpoints and disable fallback to HTTP.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123497. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...