CVE-2026-111917

Name of the Vulnerable Software and Affected Versions Vikunja versions 2.3.0 through 2.6.x

Description Improper session validation allows attackers to maintain WebSocket access even after a session has been revoked. This occurs because the handleAuth() function fails to verify the sid claim of the JSON Web Token (JWT) against the sessions table. An attacker with a stolen access token can establish or keep a connection to the '/api/v2/ws' endpoint following session deletion or Time-based One-Time Password (TOTP) enrollment, enabling them to continue receiving the victim's notification pushes, which may include content from tasks, projects, and comments.

Recommendations Update to version 2.7.0 or later.