CVE-2026-123521
MEDIUM
NVD
CVSS Score
5.9
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
Vikunja before 2.7.1 contains an improper restriction of excessive authentication attempts vulnerability that allows session holders to brute-force account passwords via unthrottled re-authentication endpoints. Attackers with a stolen session can guess the password via /user/settings/totp/disable without lockout, then disable TOTP without a code for persistent account takeover.