cyfenced.com →

[ CVE-2026-91982 · Published 15 Sep 2026 ]

Vikunja: TOTP secret is readable after enrollment, no step-up auth

CVSS 4.3 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticator, and generate valid codes indefinitely to defeat the second factor and enable account takeover.

[ Fixes ]Fixes and patches

  • code.vikunja.io/api 2.6.0Fixed version · GitHub Advisories · go package code.vikunja.io/api: upgrade to 2.6.0 or later (affected <= 2.5.0)

[ Packages ]Affected open-source packages

[ References ]References