Threats Tagged 'ghsa-m687-p538-r5hp'

Vikunja's API has a permissive Cross-Origin Resource Sharing (CORS) policy that trusts all localhost origins by default, combined with sending Access-Control-Allow-Credentials: true. This allows any page served from localhost on any port to make credentialed cross-origin requests and read responses, including the token refresh endpoint that returns a bearer token in the response body. This token grants full API access for the logged-in user. The default configuration appends localhost origins to the allowed list rather than replacing them, causing production deployments to inadvertently trust all localhost origins. An attacker controlling a page on localhost can exploit this to obtain a valid access token without user interaction.