Threats tagged 'ghsa-pvgh-54fw-mm3m'

Vikunja versions from 2.0.0 up to but not including 2.7.1 have a vulnerability where the /api/v2 login and OIDC callback endpoints accept form-encoded bodies without CSRF or Origin checks. This flaw enables login cross-site request forgery (CSRF), allowing an attacker with an account to trick a victim into switching to the attacker's account by posting the attacker's credentials or OIDC code. This can expose data that the victim subsequently adds while logged into the attacker's account.