CVE-2026-123528

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.7.1

Description Insufficient session expiration occurs because the SetupTokenMiddleware skips necessary session and account-status checks. This allows individuals possessing revoked access tokens to continue authenticating. An attacker with a stolen token can maintain persistent access by minting OAuth sessions through the '/oauth/authorize' endpoint or using tk API tokens, even after a logout, password reset, or account disabling event.

Recommendations Update to version 2.7.1.