Threats tagged 'ghsa-rg35-8p7r-mq2v'

Vikunja veans versions before 2.7.1 have a protocol downgrade vulnerability in the serverCandidates component. This flaw allows on-path attackers to force the use of plain HTTP instead of HTTPS during initialization and login. By blocking HTTPS ports, attackers can cause the client to accept unverified HTTP responses, enabling interception of sensitive data such as passwords, TOTP codes, and bot tokens, as well as cleartext API traffic.