Threats tagged 'ghsa-x6wm-4pvf-x539'

Vikunja versions prior to 2.7.1 embed live tokens for password reset, email confirmation, and account deletion in URL query strings sent via email. These URLs, when clicked, cause the full request URI including sensitive tokens to be logged in Vikunja's HTTP access logs and any reverse-proxy logs. An attacker with access to these logs could replay unredeemed tokens to hijack accounts or confirm account deletions.