Duplicate Advisory: Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited

Vikunja before version 2.6.0 fails to apply rate limiting controls on its /api/v2 public authentication endpoints, including login, register, password-reset, and OAuth token routes. This lack of throttling permits remote unauthenticated attackers to conduct unbounded credential guessing, account enumeration, and password-reset flooding attacks. The /api/v1 endpoints remain rate limited and are not affected by this issue. The vulnerability is identified as CWE-307 (Improper Restriction of Excessive Authentication Attempts).

The vulnerability allows unauthenticated remote attackers to perform unlimited authentication attempts and password reset requests without restriction, increasing the risk of credential stuffing, brute force attacks, and denial of service via password reset flooding. Confidentiality is impacted as attackers can enumerate valid accounts. Integrity and availability impacts are not indicated.

Patch status is not confirmed in the provided data; no official fix or patch links are included. Users should check the referenced advisory GHSA-6rvj-qwjf-3m4q for current remediation guidance. Until patched, consider implementing external rate limiting or other protective controls on the /api/v2 authentication endpoints to mitigate abuse.