CVE-2026-34727Disclosure(vikunja / vikunja)

LOWCVSS 9.1 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped. This vulnerability is fixed in 2.3.0.

vikunja CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

Weakness type (CWE)

CWE-287

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

vikunja

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Affected systems

Vendors

vikunja

Products

vikunja

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

CVE@CVEnew183d
Disclosure
CVE-2026-34727 Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched… https://www.cve.org/CVERecord?id=CVE-2026-34727
Post summary
The CVE concerns an OIDC callback flaw in Vikunja versions prior to 2.3.0 that improperly issues JWT tokens without validating the matched payload. No PoC, exploit code, or active exploitation is referenced.
00010726
57.0K followersView on X
Infoflowcloud@infoflowcloud183d
Disclosure
🚨*CVE* CVE-2026-34727 Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched… https://www.cve.org/CVERecord?id=CVE-2026-34727 ----- Traducción: CVE-2026-34727 Vik… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-34727 for Vikunja’s OIDC callback handler, linking to the official CVE record and providing a brief technical detail, but it does not mention exploits, patches, or active attacks.
0000039
67 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	vikunja	vikunja	-	-	-

Explore more

Back to dashboard vikunja CVEs vikunja vulnerabilities