CVE-2026-91982
Received Received - Intake

TOTP Secret Exposure in Vikunja Before 2.6.0

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticator, and generate valid codes indefinitely to defeat the second factor and enable account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91982
EUVD
EUVD-2026-78653

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vikunja vikunja to 2.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Vikunja before version 2.6.0 has a vulnerability where the raw TOTP shared secret remains exposed after enrollment. This occurs through two endpoints: GET /api/v1/user/settings/totp and GET /api/v1/user/settings/totp/qrcode. These endpoints do not require re-authentication, allowing attackers with a valid access token to retrieve the secret. Once obtained, attackers can import the secret into their own authenticator app and generate valid TOTP codes indefinitely.

Detection Guidance

Check if your Vikunja instance is running a version before 2.6.0 by inspecting the version endpoint or logs. Monitor access to the endpoints /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode for unauthorized requests.

Impact Analysis

If you use Vikunja versions before 2.6.0, an attacker with a valid access token could gain full control of your account by bypassing the second factor authentication. This could lead to unauthorized access to sensitive data, manipulation of your account, or impersonation. The impact includes potential data breaches, loss of confidentiality, and unauthorized actions performed on your behalf.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal or health data. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. A breach resulting from this vulnerability may result in regulatory penalties, loss of trust, and legal consequences for affected organizations.

Mitigation Strategies

Upgrade Vikunja to version 2.6.0 or later immediately. Review access logs for suspicious activity related to the affected endpoints. Rotate TOTP secrets for all users if the vulnerability was exploited.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91982. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart