Threats tagged 'ghsa-8h95-jvr5-q5cg'

Vikunja versions prior to 2.7.1 have a vulnerability that allows attackers holding a valid session to brute-force account passwords through unthrottled re-authentication endpoints. Specifically, attackers can repeatedly attempt password guesses via the /user/settings/totp/disable endpoint without triggering lockout mechanisms, enabling them to disable two-factor authentication (TOTP) without a code. This flaw can lead to persistent account takeover.