CVE-2026-62367

Name of the Vulnerable Software and Affected Versions Vikunja versions 1.0.0 through 2.3.0

Description When an administrator enables the per-provider emailfallback option on an OpenID Connect provider, the software links an SSO login to a pre-existing local account using only the email claim from the Identity Provider (IdP). The system fails to verify the email verified signal (or Microsoft xms edov) and does not require the local account password. This allows an attacker who can obtain a token from the configured issuer containing a victim's email to gain full session access to that victim's local account without any interaction or consent from the user. This issue specifically affects local accounts that do not have TOTP (Time-based One-Time Password) enabled, as TOTP acts as a gate for those users.

Recommendations Update to version 2.4.0. As a temporary mitigation, disable the emailfallback option for OpenID Connect providers, especially those that are untrusted or allow users to set their own email addresses without verification.