Kritik CVSS 9.1 PoC var
CVE-2026-34727: Vikunja: hatalı kimlik doğrulama
Açıklama (NVD)
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped. This vulnerability is fixed in 2.3.0.
Özet bilgiler
- Ürün
- Vikunja Vikunja
- CVSS v3.1
- 9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - EPSS
- %0,28 (yüzdelik 21)
- CWE
- CWE-287
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| vikunja-vikunja | — | — | 2.3.0 |