Api: Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted

Vikunja's default CORS configuration enables cors.origins to include 'http://127.0.0.1:*' and 'http://localhost:*' with Access-Control-Allow-Credentials set to true. The service.publicurl setting, mandatory for deployment, is appended to this list rather than replacing it, resulting in production deployments trusting localhost origins alongside the intended public URL. The refresh token endpoint authenticates using an HttpOnly, SameSite=None refresh cookie and returns a new bearer JWT token in the JSON response body. Because the browser automatically sends the refresh cookie with credentialed fetch requests, a malicious page served from any localhost port can perform a fetch to the refresh endpoint, receive the bearer token, and read it due to permissive CORS headers. This token provides full API access as the logged-in user. The vulnerability was demonstrated with a proof-of-concept that successfully obtained a valid token from a localhost page.

An attacker able to run a page on any localhost port on the victim's machine can obtain a valid bearer token for the victim's Vikunja account without needing to steal cookies or credentials directly. This token grants full API access, allowing the attacker to perform any actions the victim can. The vulnerability arises from the combination of permissive localhost CORS origins with credentialed requests and the refresh token endpoint returning tokens in the response body. This effectively allows privilege escalation from a local attacker or malicious local web content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Operators should review and explicitly configure the cors.origins setting to exclude localhost origins in production environments. Avoid relying on default CORS settings that include wildcard localhost origins. Monitor vendor advisories for an official fix or updated guidance to disable or restrict localhost origins in the CORS configuration. Until a patch is available, do not deploy Vikunja with default CORS settings in production.