Junglewise Threat Intelligence

CVE-2026-34727: Vikunja TOTP two-factor authentication bypass in OIDC callback

CVE-2026-34727 · Severity: high · CVSS 7.4 · Published 2026-04-10

Technologies: Vikunja, code.vikunja.io/api (Go). Vendors: Vikunja, Go.

Executive brief

Vikunja, an open-source task management platform, contains a security flaw where users can bypass two-factor authentication (2FA) when logging in via an external identity provider (OIDC). If a user has set up a second factor (TOTP) for their account, an attacker who manages to authenticate through a linked external account can gain full access to the user's tasks and data without being prompted for the second security code. This significantly weakens the protection intended for sensitive accounts.

Technical details

A vulnerability exists in Vikunja's OIDC authentication flow where the callback handler in `pkg/modules/auth/openid/openid.go` issues a full JWT token without verifying if the matched user has TOTP enabled. When the `EmailFallback` configuration is active, a local user account with TOTP protection can be accessed via OIDC without a second-factor challenge. This occurs because the OIDC path lacks the TOTP verification logic present in the standard local login handler. An attacker who can authenticate to a configured OIDC provider with an email address matching a local user can bypass the 2FA requirement. The issue is addressed in version 2.3.0 by adding TOTP enforcement to the OIDC callback logic.

Affected products

  • Vikunja Vikunja <= 2.2.2

Timeline

  • 2026-04-09: patched: Fix merged into main branch via PR #2582
  • 2026-04-10: advisory: GitHub Advisory GHSA-8jvc-mcx6-r4cg published

References

Related threats