CVE-2026-28268 Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse
Attackers can achieve persistent account takeover by reusing intercepted password reset tokens due to a failure to invalidate them after use.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-28268?
CVE-2026-28268 is a critical vulnerability in go-vikunja vikunja, published on 27 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever. This allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls. Version 2.1.0 contains a patch for the issue.
Which versions are affected by CVE-2026-28268?
3 open source packages ship an affected version, including code.vikunja.io/api. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
code.vikunja.io/api Go | All versions | None |
code.vikunja.io/api Go | All versions to 0.24.6 | None |
code.vikunja.io/api Go | All versions to 0.24.6 | None |
Products include Vikunja Vikunja.
How do I fix CVE-2026-28268?
Upgrade to a fixed version.
Is CVE-2026-28268 being exploited?
There is no known exploitation of CVE-2026-28268 in the wild and no public exploit code.
Other vulnerabilities in go-vikunja vikunja
- CVE-2026-27575 Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change
- CVE-2026-25935 Vikunja Affected by XSS Via Task Preview
- CVE-2026-35595 Vikunja Affected by Privilege Escalation via Project Reparenting
- CVE-2026-33316 Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement
- CVE-2026-33678 Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion
Sources
Also known as GHSA-rfjg-6m84-crj2, GO-2026-4575.