CVE-2026-123499
MEDIUM
NVD
CVSS Score
5.9
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by specifying an attacker-controlled server in .veans.yml. When veans runs in an untrusted checkout, it sends VEANS_TOKEN as a Bearer token, or login passwords, TOTP codes and tokens, to that server, granting attackers the victim's Vikunja access.