CVE-2026-91972
Received Received - Intake

Rate Limiting Bypass in Vikunja Authentication Endpoints

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote unauthenticated attackers can perform unbounded credential guessing, account enumeration, and password-reset flooding attacks without throttling restrictions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91972
EUVD
EUVD-2026-78648

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vikunja vikunja to 2.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Vikunja versions before 2.6.0 do not enforce rate limiting on public authentication endpoints like login, register, password-reset, and OAuth token routes. This allows remote attackers to repeatedly attempt credentials, enumerate accounts, or trigger password resets without any throttling.

Detection Guidance

Check if Vikunja endpoints like /api/v2/auth/login, /api/v2/auth/register, /api/v2/auth/password-reset, or /api/v2/auth/oauth/token are accessible without rate limiting. Use tools like curl to send repeated requests and observe if responses lack throttling delays. Monitor server logs for excessive authentication attempts.

Impact Analysis

Attackers could guess passwords, discover valid usernames, or flood users with password-reset emails. This may lead to unauthorized account access, data breaches, or service disruption if exploited at scale.

Mitigation Strategies

Upgrade Vikunja to version 2.6.0 or later to apply rate limiting. If upgrading is not immediately possible, implement network-level rate limiting or WAF rules to restrict repeated requests to vulnerable endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91972. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart