Vikunja is an open-source, self-hosted task management platform used by organizations to manage tasks and projects. Versions prior to 2.1.0 contain a critical business logic vulnerability (CVE-2026-28268) in the password reset functionality of the vikunja/api component. Specifically, the system fails to invalidate password reset tokens after they are used, due to a logic bug in the token cleanup cron job and incomplete cleanup (CWE-459). As a result, reset tokens remain valid indefinitely. An attacker who intercepts a reset token—through means such as compromised logs, browser history, or phishing attacks—can reuse the token at any time to reset the victim’s password and take over their account permanently. This bypasses normal authentication controls and does not require any privileges or user interaction, making exploitation straightforward and remote. The vulnerability impacts confidentiality (unauthorized access to user accounts), integrity (account takeover and potential data manipulation), and availability (potential account lockout or denial of service). The CVSS v3.1 base score is 9.8 (critical), reflecting the ease of exploitation, lack of required privileges, and severe impact. The issue is addressed in Vikunja version 2.1.0, which properly invalidates tokens upon use and fixes the token cleanup logic.

The vulnerability allows attackers to perform persistent account takeovers by reusing intercepted password reset tokens indefinitely. This compromises the confidentiality of user data and tasks, the integrity of user accounts and project information, and potentially the availability of accounts if attackers lock out legitimate users. Organizations relying on Vikunja for task management risk unauthorized access to sensitive project data and internal workflows. The ease of exploitation without authentication or user interaction increases the likelihood of attacks, especially in environments where logs or browser histories are accessible or phishing is feasible. Persistent access can lead to data exfiltration, sabotage of task management processes, and lateral movement within organizational networks if Vikunja accounts are linked to other systems. The vulnerability undermines trust in the platform’s security and may lead to operational disruptions and reputational damage.

1. Upgrade all Vikunja instances to version 2.1.0 or later immediately to apply the official patch that fixes token invalidation and cleanup logic. 2. Review and secure logging configurations to ensure password reset tokens are not logged or stored in accessible locations such as browser histories or shared logs. 3. Implement monitoring and alerting for unusual password reset activity or repeated use of reset tokens. 4. Educate users about phishing risks and encourage safe handling of password reset emails and tokens. 5. Consider implementing additional multi-factor authentication (MFA) on accounts to reduce the impact of compromised reset tokens. 6. Regularly audit and rotate credentials and tokens where possible. 7. If upgrading is not immediately possible, temporarily disable password reset functionality or restrict it to trusted networks until patched. 8. Conduct penetration testing and security assessments focused on authentication mechanisms to detect similar logic flaws.