Threats tagged 'ghsa-vvrr-xxjj-fc78'

Vikunja versions prior to 2.7.1 have a vulnerability in session expiration handling. This flaw allows users holding revoked access tokens to continue authenticating because the SetupTokenMiddleware bypasses session and account-status verification. Consequently, attackers with stolen tokens can maintain persistent access by minting OAuth sessions or API tokens even after logout, password reset, or account disabling.