Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped. This vulnerability is fixed in 2.3.0.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-8jvc-mcx6-r4cg | Vikunja has TOTP Two-Factor Authentication Bypass via OIDC Login Path |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 10 Apr 2026 16:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking whether the matched user has TOTP two-factor authentication enabled. When a local user with TOTP enrolled is matched via the OIDC email fallback mechanism, the second factor is completely skipped. This vulnerability is fixed in 2.3.0. | |
| Title | Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path | |
| Weaknesses | CWE-287 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-04-10T15:45:30.662Z
Reserved: 2026-03-30T18:41:20.753Z
Link: CVE-2026-34727
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-04-10T16:16:31.853
Modified: 2026-04-10T16:16:31.853
Link: CVE-2026-34727
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses