CVE-2026-123513
Deferred Deferred - Pending Action

Vikunja Credential Exposure via API URL Switching

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer token and desktop OAuth refresh token are sent to the attacker's server, enabling account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123513
EUVD
EUVD-2026-119398

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vikunja vikunja to 2.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-201 The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Vikunja before version 2.7.1 has a vulnerability where stored authentication tokens can be stolen. If a user is tricked into changing the frontend API URL, the application fails to clear tokens from localStorage. This causes sensitive tokens like bearer tokens and OAuth refresh tokens to be sent to the attacker's server, allowing unauthorized account access.

Detection Guidance

Check if your Vikunja instance is running a vulnerable version (before 2.7.1) by running: vikunja version. Inspect browser localStorage for auth tokens after API URL changes to detect unexpected token persistence.

Impact Analysis

An attacker could gain full access to your Vikunja account by stealing your authentication tokens. This could lead to unauthorized data access, modification, or deletion. The attack requires user interaction, such as clicking a malicious link or changing the API URL.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR and HIPAA compliance requirements. It may result in data breaches, unauthorized disclosures, and failure to protect personal or health information, potentially leading to legal penalties.

Mitigation Strategies

Upgrade Vikunja to version 2.7.1 or later immediately. Clear all stored auth tokens in browsers after upgrading. Ensure users are aware of the risk from changing API URLs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123513. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...