OpenAM versions prior to 16.1.4 contain an open redirect vulnerability that allows remote attackers to redirect users to attacker-controlled sites after SAML 1.x single sign-on. This occurs due to loose matching of trusted partner destinations, enabling crafted links to redirect authenticated users to phishing sites.
OpenAM versions before 16.1.4 have an output encoding vulnerability that allows a SAML 1.x identity provider to inject unencoded content into the service provider's auto-submitted form. This can lead to altered attribute values received by the application, compromising attribute integrity. The issue is fixed in version 16.1.4.
OpenAM versions before 16.1.4 contain a stored cross-site scripting (XSS) vulnerability. Privileged attackers can inject malicious script into a user's display name. When a victim views the OAuth 2.0 / OpenID Connect consent page, the injected script executes and can steal the victim's OpenAM session cookie, enabling user impersonation. This vulnerability is fixed in OpenAM version 16.1.4.
OpenAM versions prior to 16.1.4 contain a vulnerability where SAML 1.x assertions or responses are not properly verified to ensure the signature matches the claimed issuer. This allows an attacker with access to any private key in OpenAM's keystore to forge assertions impersonating other trusted partners, including privileged users.
OpenAM versions before 16.1.4 contain a server-side request forgery (SSRF) vulnerability. This flaw allows attackers registering UMA resource sets to specify scope description URLs that trigger internal HTTP requests. These requests can target internal hosts or cloud metadata endpoints when OpenAM sends pending-request notification emails, enabling internal network probing. The vulnerability is fixed in version 16.1.4.
OpenAM versions prior to 16.1.4 contain a server-side request forgery (SSRF) vulnerability that allows administrators, including delegated realm administrators, to cause the server to fetch arbitrary URLs via federation configuration wizard metadata URLs. This can be exploited to probe internal network resources or cloud metadata endpoints and read partial responses.
CVE-2026-123535 is a vulnerability in Tornado versions before 6.6 where the max_age argument of RequestHandler.set_cookie and related methods is not properly validated. This flaw allows an attacker to inject additional Set-Cookie attributes such as Domain, Path, or Secure by supplying attacker-controlled input as max_age, potentially expanding the cookie's scope to parent paths or other subdomains. The issue is fixed in Tornado 6.6.
Tornado versions prior to 6.6 have a path traversal vulnerability in the RequestHandler.static_url() and get_version() methods. This flaw allows attackers to use '../' sequences to access files outside the intended static directory. By controlling input to static_url(), attackers can obtain SHA-512 hashes of readable files to verify their existence or reference special files like /dev/zero to disrupt the event loop.
CVE-2026-123533 is a denial of service vulnerability in gitoxide's gix-commitgraph component before version 0.42.0 and gitoxide before version 0.61.0. The vulnerability arises because the commit-graph parser does not properly validate parent graph positions against the declared commit count and fails to check the EDGE chunk length for 4-byte alignment. This can cause panics that abort commands like gix merge-base, gix blame, and other applications embedding gix when processing a crafted commit-graph file.
CVE-2026-123532 is a vulnerability in gitoxide's gix-fs component before version 0.24.1 that allows remote attackers to capture NTLM credentials on Windows systems. This occurs when a crafted repository contains UNC symlink targets and a victim checks out the repository with symlinks enabled. The vulnerability causes SMB authentication to be triggered, leaking the username, domain, and NTLMv2 hash.
Vikunja versions from 1.0.0 up to but not including 2.7.1 have a vulnerability that allows authenticated users to bypass the service.maxitemsperpage limit by sending page=0 to certain API list endpoints. This triggers unbounded SQL queries and excessive memory use, which can degrade service availability. The issue is fixed in version 2.7.1.
Vikunja versions prior to 2.7.1 have a missing authentication vulnerability that allows an attacker with a stolen session to enroll and enable TOTP (Time-based One-Time Password) without needing the account password. This enables the attacker to set their own TOTP secret, effectively locking the legitimate user out of their account, and this lockout persists even after a password reset.
Vikunja versions prior to 2.7.1 contain a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. This can enable attackers to create phishing overlays or force background-image requests that deanonymize viewers. The vulnerability is fixed in version 2.7.1.
Vikunja versions before 2.7.1 have an insufficient session expiration vulnerability. This flaw allows attackers holding revoked access tokens to continue authenticating because the SetupTokenMiddleware bypasses session and account status checks. As a result, attackers with stolen tokens can mint new OAuth sessions or API tokens even after logout, password reset, or account disabling, enabling persistent unauthorized access.
Vikunja versions from 2.4.0 up to but not including 2.7.1 have an authorization bypass vulnerability due to colliding v1 and v2 API token permission keys. This flaw allows attackers holding tokens with limited permissions to perform unauthorized actions such as deleting project backgrounds or updating buckets. The issue is fixed in version 2.7.1.
Vikunja versions before 2.7.1 have a mass assignment vulnerability that allows authenticated users to modify the read-only external_id field via team create and update endpoints. This flaw enables attackers to mark a team as externally managed, which prevents removal of members and causes SSO members to be dropped upon their next login. The issue is fixed in version 2.7.1.
CVE-2026-123525 affects Vikunja versions before 2.7.1 and involves unbounded memory allocation in its Trello, Todoist, and Microsoft To Do migration importers. Authenticated users can trigger migrations that cause excessive memory use by referencing large attachments or oversized API responses, leading to memory exhaustion and crashing the shared API process for all tenants.
Vikunja versions from 0.23.0 up to but not including 2.7.1 have an authorization flaw that allows project collaborators with write access to access task details from projects they should not have access to. This occurs via webhook registration, where webhook payloads are generated with the triggering user's permissions, exposing titles, descriptions, and metadata of tasks in private projects when linked tasks are modified. The vulnerability is fixed in version 2.7.1.
Vikunja versions before 2.7.1 have a vulnerability that allows authenticated users to exhaust server memory by requesting avatars at many distinct sizes. This uncontrolled resource consumption can cause the API process to be terminated due to out-of-memory conditions. The issue is fixed in version 2.7.1.
Vikunja versions prior to 2.7.1 have an authorization bypass vulnerability that allows authenticated users to read any task by injecting a crafted task object during a no-op Kanban bucket move. This flaw enables attackers to access full task contents of other users by manipulating task identifiers and project associations, potentially exposing sensitive information.