Threats tagged 'ghsa-w28c-4vf4-mf4p'

Vikunja veans versions before 2.7.1 have a credential exposure vulnerability. Malicious repository authors can specify an attacker-controlled server in the .veans.yml configuration file. When veans runs in an untrusted checkout, it may send sensitive credentials such as the VEANS_TOKEN bearer token, login passwords, TOTP codes, and other tokens to the attacker-controlled server. This exposure grants attackers access to the victim's Vikunja account.