Threats tagged 'ghsa-7jfp-xpw2-2j25'

Vikunja versions prior to 2.7.1 have a missing authentication vulnerability that allows attackers with a stolen session to enroll and enable TOTP (Time-based One-Time Password) without needing the account password. This enables attackers to call the TOTP enroll and enable endpoints using their own secret, effectively locking the legitimate user out of their account. This lockout persists even after the user resets their password.