In Vikunja versions before 2.3.0, the OIDC callback handler improperly authenticates users by issuing a full JWT token without checking if the matched local user has TOTP two-factor authentication enabled. Specifically, when a local user with TOTP enrolled is matched through the OIDC email fallback mechanism, the second factor is skipped entirely, resulting in improper authentication (CWE-287). This vulnerability allows attackers to bypass two-factor authentication, potentially leading to unauthorized access. The vulnerability has a CVSS 3.1 score of 7.4, indicating high severity. The issue is resolved in Vikunja 2.3.0.

The vulnerability allows an attacker to bypass two-factor authentication (TOTP) for local users when authenticated via the OIDC email fallback mechanism. This can lead to unauthorized access with full privileges of the targeted user. The impact includes confidentiality and integrity compromise but does not affect availability. The CVSS score of 7.4 reflects a high severity due to network attack vector and no user interaction required.

Upgrade Vikunja to version 2.3.0 or later, where this vulnerability is fixed. Since no official patch links or vendor advisory details are provided, users should verify the upgrade from the official Vikunja project sources. Patch status is not explicitly confirmed beyond the fix in 2.3.0, so check vendor advisories for the latest remediation guidance.