Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 1234, password) without enforcing minimum strength requirements. Additionally, active sessions remain valid after a user changes their password. An attacker who compromises an account (via brute-force or credential stuffing) can maintain persistent access even after the victim resets their password. Version 2.0.0 contains a fix.
The application does not enforce minimum password strength requirements (CWE-521), which facilitates account takeover via brute-force or credential stuffing methods. After successful account compromise, the attacker's existing sessions are not invalidated when the victim changes their password (CWE-613). This means that even if the user detects the breach and changes their password, the attacker retains an active session and uninterrupted access to the account.
An attacker can gain unauthorized access to a user account and then maintain it permanently even after the victim changes their password — leading to disclosure of confidential task and project data and modification of resources on the platform.
Vikunja should be updated to version 2.0.0, which contains a fix enforcing minimum password strength requirements and invalidating active sessions after password change.
Vikunja (open-source, self-hosted) in all versions before 2.0.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NVikunja
APPVikunja< 2.0.0
Related vulnerabilities
Vikunja: wielokrotne użycie tokenu resetowania hasła — przejęcie konta
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/mod...
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issu...
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, `TaskAttachment.ReadOn...
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s pa...