CVE-2026-91972 Vikunja before 2.6.0 Authentication Bypass via Unthrottled API
Remote attackers can bypass authentication rate limits to perform credential guessing and account enumeration on Vikunja task manager.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-91972?
CVE-2026-91972 is a high-severity authentication bypass vulnerability in go-vikunja vikunja, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote unauthenticated attackers can perform unbounded credential guessing, account enumeration, and password-reset flooding attacks without throttling restrictions.
Weakness: CWE-307
Which versions are affected by CVE-2026-91972?
3 open source packages ship an affected version, including code.vikunja.io/api.
| Package | Affected | Fixed in |
|---|---|---|
code.vikunja.io/api Go | All versions | None |
code.vikunja.io/api Go | All versions | 2.6.0 |
code.vikunja.io/api Go | All versions | 2.6.0 |
How do I fix CVE-2026-91972?
Upgrade code.vikunja.io/api to 2.6.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-91972 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-91972 exists.
Sources
Also known as GHSA-6rvj-qwjf-3m4q, GO-2026-6721.