CVE-2026-123497
MEDIUM
NVD
CVSS Score
6.8
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.