CVE-2026-91982

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.6.0

Description The software exposes the raw Time-based One-Time Password (TOTP) shared secret after enrollment. This occurs through the 'GET /api/v1/user/settings/totp' and 'GET /api/v1/user/settings/totp/qrcode' endpoints without requiring re-authentication. An attacker possessing a valid access token can retrieve this secret and import it into an authenticator app to generate valid codes indefinitely, bypassing the second factor authentication and enabling account takeover.

Recommendations Update to version 2.6.0 or later.