CVE-2026-91972 identifies an improper restriction of excessive authentication attempts vulnerability in go-vikunja's vikunja product. Versions before 2.6.0 fail to apply rate limiting controls on critical public authentication endpoints such as /api/v2 login, register, password-reset, and OAuth token routes. This deficiency enables remote unauthenticated attackers to conduct unbounded brute force attacks, enumerate valid accounts, and flood password reset functionality without any throttling or mitigation controls.

The vulnerability allows attackers to perform unlimited credential guessing attempts, which can lead to unauthorized access if weak credentials are used. Additionally, attackers can enumerate valid user accounts and abuse password reset functionality to potentially disrupt user accounts or facilitate further attacks. The lack of throttling increases the risk of automated attacks and reduces the effectiveness of defensive controls.

A fix is available in vikunja version 2.6.0 and later, which implements rate limiting on the affected authentication endpoints. Users should upgrade to version 2.6.0 or newer to remediate this vulnerability. No vendor advisory content is provided, but the affectedVersions field indicates the fix is included starting from 2.6.0.