CVE-2026-33473

Published: Mar 24, 2026Modified: Jun 17, 2026

5.7

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.1 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Vikunja is an open-source self-hosted task management platform. Starting in version 0.13 and prior to version 2.2.1, any user that has enabled 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.2.1 patches the issue.

Affected (1)

Products: Vikunja: Vikunja

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Vikunja Vikunja	From 0.13 to 2.2.1

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (3)

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-p747-qc5p-773r

Source: security-advisories@github.com

ExploitVendor Advisory

https://vikunja.io/changelog/vikunja-v2.2.0-was-released

Source: security-advisories@github.com

Release Notes

https://vikunja.io/changelog/vikunja-v2.2.2-was-released

Source: security-advisories@github.com

Release Notes

Timeline

No history available yet.