CVE-2026-123528
Deferred Deferred - Pending Action

Insufficient Session Expiration in Vikunja

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account disabling, mint OAuth sessions via /oauth/authorize or tk_ API tokens for persistent access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123528
EUVD
EUVD-2026-119413

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vikunja vikunja to 2.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Vikunja before version 2.7.1 has an insufficient session expiration vulnerability. This means that even after a user logs out, resets their password, or has their account disabled, revoked access tokens can still be used to authenticate. The SetupTokenMiddleware fails to check session and account status properly, allowing attackers with a stolen token to create new OAuth sessions or API tokens for continued unauthorized access.

Detection Guidance

To detect this vulnerability, check Vikunja logs for unauthorized OAuth sessions or API token creation after logout, password reset, or account disablement. Monitor for repeated /oauth/authorize requests or tk_ API token generation from revoked sessions. Ensure session checks are enforced in HTTP token middleware.

Impact Analysis

If you use Vikunja before 2.7.1, attackers could gain persistent access to your account even after you take steps to revoke access. This could lead to unauthorized data access, data theft, or modifications to your data. The vulnerability undermines standard security practices like account disabling or logout functionality.

Compliance Impact

This vulnerability could violate compliance requirements that mandate timely revocation of access and protection of sensitive data. For GDPR, it may breach principles of data minimization and security. For HIPAA, it could compromise the integrity and confidentiality of protected health information by allowing unauthorized access to persist.

Mitigation Strategies

Upgrade Vikunja to version 2.7.1 or later to patch the vulnerability. Review and revoke all active sessions and tokens. Implement stricter session validation in the HTTP token middleware to check session existence and account status. Monitor for unauthorized access attempts post-upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123528. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...