Vikunja Session Hijacking via Missing Authentication in TOTP Enrollment

Executive Summary

Vikunja before version 2.7.1 has a missing authentication vulnerability (CVE-2026-123530) where attackers with a stolen session can enroll and enable TOTP without the account password. This allows attackers to lock legitimate users out of their accounts by enabling TOTP with their own secret. Even after a password reset, the TOTP remains active, persisting the attacker's access.

Useful 0 Not Useful 0

Detection Guidance

Check Vikunja server logs for unusual TOTP enrollment or enablement requests. Look for POST requests to /api/v1/totp/enroll or /api/v1/totp/enable endpoints with session tokens not tied to the account owner. Monitor for multiple failed login attempts followed by TOTP activation.

Useful 0 Not Useful 0

Impact Analysis

If you are a Vikunja user before version 2.7.1, an attacker with a stolen session could lock you out of your account by enabling TOTP. This prevents you from accessing your account even after resetting your password. Attackers may also create persistent API tokens to maintain access indefinitely.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR's data protection principles and HIPAA's security requirements. Unauthorized access may result in data breaches, non-compliance with access control regulations, and potential legal penalties for affected organizations.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade Vikunja to version 2.7.1 or later to patch the missing authentication flaw.
• Review and revoke all active sessions for users who may have been affected by this vulnerability.
• Enable step-up authentication for critical functions like TOTP enrollment in your authentication system.
• Audit API tokens created during the vulnerable period and revoke any suspicious ones.

Useful 0 Not Useful 0