CVE-2026-62367: CWE-287: Improper Authentication in go-vikunja vikunja

In Vikunja versions 1.0.0 through 2.3.0, enabling the per-provider 'emailfallback' option on an OpenID Connect provider causes the system to link an SSO login to an existing local account using only the email claim from the identity provider. The fallback mechanism does not verify the 'email_verified' claim or equivalent signals and does not require the matched local account's password. Consequently, an attacker who can obtain a token from the configured issuer that carries a victim's email can log in as that victim with a full session without any victim interaction or consent. This vulnerability is classified under CWE-287 (Improper Authentication) and related weaknesses. The issue is resolved in version 2.4.0.

An attacker who can obtain a token from the configured OpenID Connect issuer containing a victim's email can impersonate that victim in Vikunja without needing the victim's password or consent. This leads to unauthorized access to the victim's account and potentially sensitive task management data. The vulnerability has a high severity with a CVSS 4.0 score of 7.5, reflecting the significant impact on confidentiality, integrity, and availability.

Upgrade Vikunja to version 2.4.0 or later, where this vulnerability is fixed. The fix ensures proper verification of the email claim and requires appropriate authentication checks before linking SSO logins to local accounts. Until upgrading, disable the 'emailfallback' option on OpenID Connect providers to prevent exploitation.