Threats tagged 'ghsa-vv55-5rp5-mff9'

Vikunja versions prior to 2.7.1 have a cross-site request forgery (CSRF) vulnerability in the OAuth migration callbacks for Todoist, Microsoft To Do, and Trello. The lack of a bound state parameter allows attackers to trick logged-in users into importing attacker-controlled projects and tasks, potentially containing phishing links.