PT-2026-139794
CVE-2026-123513
·
Published
2026-11-08
·
Updated
2026-11-08
Description by
CVSS 3.1
6.8
MediumMetricsAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer token and desktop OAuth refresh token are sent to the attacker's server, enabling account takeover.
Found an issue in the description? Have something to add? Feel free to write us 👾