CVE-2026-28268
Critical · 9.8CVSS
9.8
EPSS
0.9%
Published
Feb 27, 2026
CISA due date
—
The record
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to invalidate tokens upon use and a critical logic bug in the token cleanup cron job, reset tokens remain valid forever. This allows an attacker who intercepts a single reset token (via logs, browser history, or phishing) to perform a complete, persistent account takeover at any point in the future, bypassing standard authentication controls. Version 2.1.0 contains a patch for the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | code.vikunja.io/api | 0 | No fix |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260317T205859-150000.1.152.1 |
Related vulnerabilities
- GHSA-rfjg-6m84-crj2 Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse Same vulnerability
- GHSA-42wg-38gx-85rh Vikunja has Path Traversal in CLI Restore Also affects code.vikunja.io/api
- GHSA-7jp5-298q-jg98 Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure Also affects code.vikunja.io/api
- CVE-2026-27819 Vikunja is an open-source self-hosted task management platform. Also affects code.vikunja.io/api
- CVE-2026-27575 Vikunja is an open-source self-hosted task management platform. Also affects code.vikunja.io/api
- CVE-2026-27616 Vikunja is an open-source self-hosted task management platform. Also affects code.vikunja.io/api
- CVE-2026-27116 Vikunja is an open-source self-hosted task management platform. Also affects code.vikunja.io/api
- GHSA-3ccg-x393-96v8 Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change Also affects code.vikunja.io/api