PT-2026-92091 · Vikunja · Vikunja

Jellowbeanz26

·

CVE-2026-91972

·

Published

2026-09-15

·

Updated

2026-10-09

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.6.0
Description Public authentication endpoints under /api/v2, including login, register, password-reset, and OAuth token routes, do not implement rate limiting. This allows remote unauthenticated attackers to execute unbounded credential guessing, account enumeration, and password-reset flooding attacks without throttling restrictions.
Recommendations Update to version 2.6.0 or later.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2026-91972
GHSA-6RVJ-QWJF-3M4Q
GHSA-M4VJ-WR5Q-CMVR

Affected Products

Vikunja