Api: Duplicate Advisory: Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords

Vikunja before version 2.6.0 contains an authentication bypass vulnerability in its CalDAV BasicAuth endpoints (/dav, /.well-known, and /feeds) because these endpoints lack rate limiting. This absence of rate limiting enables remote unauthenticated attackers to perform unbounded credential-guessing attacks, effectively bypassing the instance's anti-brute-force controls and risking compromise of accounts protected only by passwords.

The vulnerability allows remote attackers to bypass anti-brute-force protections by making unlimited authentication attempts against BasicAuth endpoints. This can lead to compromise of password-only accounts, resulting in unauthorized access. There is no indication of impact on integrity or availability, but confidentiality is at high risk.

A fix is available in Vikunja version 2.6.0 and later. Users should upgrade to version 2.6.0 or newer to remediate this vulnerability. Patch status is confirmed by the versioning information indicating affected versions are up to 2.5.0 and fixed in 2.6.0. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.