CVE-2026-33315
Bypass of 2FA via Basic Auth in Vikunja Caldav Endpoint
Publication date: 2026-03-24
Last updated on: 2026-03-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vikunja | vikunja | to 2.2.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-288 | The product requires authentication, but the product has an alternate path or channel that does not require authentication. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Vikunja, an open-source self-hosted task management platform, prior to version 2.2.0. The issue is that the Caldav endpoint allows login using Basic Authentication, which enables users to bypass the Time-based One-Time Password (TOTP) on accounts that have two-factor authentication (2FA) enabled.
As a result, an attacker or unauthorized user can access project information such as project name and description that should normally be protected by 2FA. This bypass undermines the security provided by 2FA on the platform.
The vulnerability was patched in version 2.2.0 of Vikunja.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized access to project information that should be protected by two-factor authentication.
If you have 2FA enabled on your Vikunja account, an attacker could bypass this protection via the Caldav endpoint using Basic Authentication, gaining access to sensitive project details such as project names and descriptions.
This could lead to exposure of confidential project information, potentially compromising privacy and security within your organization.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Vikunja to version 2.2.0 or later, as this version patches the issue where the Caldav endpoint allows bypassing TOTP on 2FA-enabled accounts.