CVE-2026-123495
MEDIUM
NVD
CVSS Score
4.6
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or Origin checks, enabling login cross-site request forgery. An attacker with an account can lure a victim to a page posting the attacker's credentials or OIDC code, switching the victim into the attacker's account and exposing data the victim then adds.