Threats tagged 'ghsa-h52v-3vxf-m2vc'

Vikunja versions prior to 2.7.1 have a credential exposure vulnerability that allows attackers to steal stored authentication tokens. This occurs when an attacker tricks a user into switching the frontend API URL, causing the application to send bearer tokens and OAuth refresh tokens to the attacker's server. This vulnerability can lead to account takeover.