CVE-2026-27575
Weak Password Enforcement and Session Persistence in Vikunja Prior to
Publication date: 2026-02-25
Last updated on: 2026-03-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vikunja | vikunja | to 2.0.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-521 | The product does not require that users should have strong passwords. |
| CWE-613 | According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Vikunja, an open-source self-hosted task management platform, in versions prior to 2.0.0. The application allowed users to set weak passwords such as "1234" or "password" without enforcing any minimum password strength requirements. Additionally, when a user changed their password, their active sessions remained valid. This means that if an attacker compromised an account through brute-force attacks or credential stuffing, they could maintain persistent access to the account even after the legitimate user reset their password.
How can this vulnerability impact me? :
The vulnerability can have a significant impact by allowing attackers to gain and maintain unauthorized access to user accounts. Because weak passwords are permitted, accounts are more susceptible to brute-force or credential stuffing attacks. Furthermore, the failure to invalidate active sessions after a password change means that attackers who have already compromised an account can continue to access it despite the victim's attempt to secure their account by changing the password. This can lead to unauthorized access to sensitive task management data and potential misuse of the platform.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Vikunja to version 2.0.0 or later, as this version contains the fix that enforces minimum password strength requirements and invalidates active sessions after password changes.