CVE-2026-123513
MEDIUM
NVD
CVSS Score
6.8
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer token and desktop OAuth refresh token are sent to the attacker's server, enabling account takeover.