CVE-2026-91973 describes an authentication bypass vulnerability in go-vikunja's Vikunja product prior to version 2.6.0. The issue arises because the CalDAV BasicAuth endpoints (/dav, /.well-known, and /feeds) do not implement rate limiting, enabling remote unauthenticated attackers to perform unbounded credential guessing attempts. This lack of restriction can bypass anti-brute-force mechanisms and compromise accounts protected only by passwords.

The vulnerability allows remote unauthenticated attackers to bypass anti-brute-force controls by issuing unlimited authentication attempts against specific CalDAV BasicAuth endpoints. This can lead to compromise of password-only accounts, potentially allowing unauthorized access to user data or services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external rate limiting or other access controls on the affected endpoints to mitigate brute-force attempts.