CVE-2026-91973 Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth
Remote attackers can bypass anti-brute-force controls on CalDAV endpoints to guess passwords and compromise accounts in Vikunja.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-91973?
CVE-2026-91973 is a high-severity authentication bypass vulnerability in go-vikunja vikunja, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated attackers can issue unbounded credential-guessing requests against /dav, /.well-known, and /feeds routes to bypass the instance's anti-brute-force controls and compromise password-only accounts.
Weakness: CWE-307
Which versions are affected by CVE-2026-91973?
3 open source packages ship an affected version, including code.vikunja.io/api.
| Package | Affected | Fixed in |
|---|---|---|
code.vikunja.io/api Go | All versions | None |
code.vikunja.io/api Go | All versions | 2.6.0 |
code.vikunja.io/api Go | All versions | 2.6.0 |
How do I fix CVE-2026-91973?
Upgrade code.vikunja.io/api to 2.6.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-91973 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-91973 exists.
Sources
Also known as GHSA-m469-88xx-8rx2, GO-2026-6737.