# CVE-2026-123528: Vikunja insufficient session expiration in HTTP token middleware

Source: https://junglewise.ai/threats/cve-2026-123528-vikunja-before-2-7-1-contains-an-insufficient-session-expiration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-123528 · Severity: medium · CVSS 6.8 · Published 2026-11-08

Vikunja is a task management and collaboration platform. After a user logs out, changes their password, or an administrator disables their account, stolen access tokens continue to work for up to 10 minutes and can be used to create longer-lived credentials that survive the revocation. This allows attackers to maintain persistent access to an account even after the user believes they have fully logged out.

Technologies: [Vikunja](https://junglewise.ai/threats/technologies/vikunja). Vendors: [Vikunja](https://junglewise.ai/threats/vendors/vikunja).

## Quick answers

**Is CVE-2026-123528 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123528 being exploited in the wild.

**How severe is CVE-2026-123528?** Medium severity, with a CVSS score of 6.8, published 8 November 2026.

**Which products and versions are affected?** Vikunja before 2.7.1.

**Is there a fix for CVE-2026-123528?** Yes: fixed in 2.7.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123528 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-123528?** Check whether you run Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.7.1

## Technical details

The SetupTokenMiddleware validates JWT tokens only for signature and expiry but skips session and account-status checks, unlike the WebSocket authentication path which properly validates that the session still exists. An attacker with a valid access token can mint durable OAuth sessions (up to 72 hours) or API tokens with arbitrary expiry via /oauth/authorize and token creation endpoints, both of which survive logout and password reset. The vulnerability requires an already-valid token and cannot be exploited by unauthenticated users.

## Affected products

- Vikunja Vikunja before 2.7.1

## Timeline

- 2026-10-22: disclosed
- 2026-11-08: advisory

## References

- [https://github.com/go-vikunja/vikunja/security/advisories/GHSA-4qvp-948j-4cgv](https://github.com/go-vikunja/vikunja/security/advisories/GHSA-4qvp-948j-4cgv)
- [https://www.vulncheck.com/advisories/vikunja-before-2.7.1-insufficient-session-expiration-via-http-token-middleware](https://www.vulncheck.com/advisories/vikunja-before-2.7.1-insufficient-session-expiration-via-http-token-middleware)

## Related threats

- [Vikunja denial of service via pagination bypass in API v1](https://junglewise.ai/threats/cve-2026-123531-vikunja-from-1-0-0-before-2-7-1-contains-an-uncontrolled)
- [Vikunja missing authentication in TOTP enrollment](https://junglewise.ai/threats/cve-2026-123530-vikunja-before-2-7-1-contains-a-missing-authentication)
- [Vikunja stored CSS injection in rich-text table cells](https://junglewise.ai/threats/cve-2026-123529-vikunja-before-2-7-1-contains-a-stored-css-injection)
- [Vikunja API token authorization bypass in v1/v2 collision](https://junglewise.ai/threats/cve-2026-123527-vikunja-from-2-4-0-before-2-7-1-contains-an-authorization-bypass)
- [Vikunja mass assignment in team external_id field](https://junglewise.ai/threats/cve-2026-123526-vikunja-before-2-7-1-contains-a-mass-assignment-vulnerability)