Security Advisory

CVE-2026-91982

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-15 15:18:26

Last updated 2026-09-15 15:18:26

Assigner VulnCheck

CVSS score 5.3

State PUBLISHED

Description

Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication. Attackers with a valid access token can read the secret, import it into their own authenticator, and generate valid codes indefinitely to defeat the second factor and enable account takeover.

← Browse all CVEs View on cve.org ↗