CVE-2026-91982: Insufficiently Protected Credentials in go-vikunja vikunja
Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticator, and generate valid codes indefinitely to defeat the second factor and enable account takeover.
AI Analysis
Technical Summary
CVE-2026-91982 describes a vulnerability in Vikunja prior to version 2.6.0 where the raw Time-based One-Time Password (TOTP) shared secret is exposed through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without requiring the user to re-authenticate. An attacker possessing a valid access token can exploit this to obtain the secret, import it into their own authenticator, and generate valid TOTP codes indefinitely, effectively bypassing the second factor of authentication and enabling account compromise.
Potential Impact
The vulnerability allows an attacker with a valid access token to bypass two-factor authentication by obtaining the TOTP shared secret and generating valid authentication codes indefinitely. This compromises the integrity of the second factor and can lead to unauthorized account access. The CVSS score of 4.3 (medium severity) reflects the requirement for a valid access token and the limited confidentiality impact.
Mitigation Recommendations
Users and administrators should upgrade Vikunja to version 2.6.0 or later, where this issue is fixed. Patch status is confirmed by the version boundary in the affectedVersions field. Until upgrading, restrict access tokens and monitor for unauthorized access. No vendor advisory was provided, so patch status is inferred from the version information.
CVE-2026-91982: Insufficiently Protected Credentials in go-vikunja vikunja
Description
Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticator, and generate valid codes indefinitely to defeat the second factor and enable account takeover.
CVSS v3.1
Score 4.3medium
Affected software
go-vikunja
vikunja
pkg:golang/github.com/go-vikunja/vikunjaRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-91982 describes a vulnerability in Vikunja prior to version 2.6.0 where the raw Time-based One-Time Password (TOTP) shared secret is exposed through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without requiring the user to re-authenticate. An attacker possessing a valid access token can exploit this to obtain the secret, import it into their own authenticator, and generate valid TOTP codes indefinitely, effectively bypassing the second factor of authentication and enabling account compromise.
Potential Impact
The vulnerability allows an attacker with a valid access token to bypass two-factor authentication by obtaining the TOTP shared secret and generating valid authentication codes indefinitely. This compromises the integrity of the second factor and can lead to unauthorized account access. The CVSS score of 4.3 (medium severity) reflects the requirement for a valid access token and the limited confidentiality impact.
Mitigation Recommendations
Users and administrators should upgrade Vikunja to version 2.6.0 or later, where this issue is fixed. Patch status is confirmed by the version boundary in the affectedVersions field. Until upgrading, restrict access tokens and monitor for unauthorized access. No vendor advisory was provided, so patch status is inferred from the version information.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-15T11:10:41.353Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa9651e55bf5e2cf502eb2e
Added to database: 09/15/2026, 15:32:46 UTC
Last enriched: 09/15/2026, 15:47:21 UTC
Last updated: 09/16/2026, 03:16:37 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.