Security Advisory

CVE-2026-91972

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-15 15:18:22

Last updated 2026-09-15 15:18:22

Assigner VulnCheck

CVSS score 8.7

State PUBLISHED

Description

Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote unauthenticated attackers can perform unbounded credential guessing, account enumeration, and password-reset flooding attacks without throttling restrictions.

← Browse all CVEs View on cve.org ↗