cyfenced.com →

[ CVE-2026-91973 · Published 15 Sep 2026 ]

Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords

CVSS 7.5 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's anti-brute-force controls and compromise password-only accounts.

[ Fixes ]Fixes and patches

  • code.vikunja.io/api 2.6.0Fixed version · GitHub Advisories · go package code.vikunja.io/api: upgrade to 2.6.0 or later (affected <= 2.5.0)

[ Packages ]Affected open-source packages

[ References ]References