Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Vikunja is an open-source self-hosted task management platform. Starting in version 0.13 and prior to version 2.2.1, any user that has enabled 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.2.1 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-24 | 1 | General1 |
| 2026-09-21 | 1 | Disclosure1 |
🟠 Go TOTP Library (pquerna/otp), TOTP Reuse Vulnerability, #CVE-2026-33473 (Medium) -DC-Sep2026-2501 https://dailycve.com/go-totp-library-pquerna-otp-totp-reuse-vulnerability-cve-2026-33473-medium-dc-sep2026-2501/
Post summary
The post announces CVE-2026-33473, a Medium-severity TOTP reuse vulnerability in the Go pquerna/otp library, providing technical details but no exploit, PoC, patch, or exploitation claims.
CVE-2026-33473 Vikunja is an open-source self-hosted task management platform. Starting in version 0.13 and prior to version 2.2.1, any user that has enabled 2FA can have their TOTP… https://www.cve.org/CVERecord?id=CVE-2026-33473
Post summary
The passage briefly notes CVE‑2026‑33473 affecting Vikunja’s 2FA TOTP, but it provides no proof‑of‑concept, exploit, patch, or detailed technical data.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vikunja | vikunja | - | - | - |