Executive brief
Vikunja, an open-source task management platform, contains a flaw in its two-factor authentication (2FA) system. An attacker who has already stolen a user's password can bypass the secondary security code requirement by repeatedly guessing the code. While the system is supposed to lock accounts after 10 failed attempts, a technical error prevents this lockout from being saved, allowing for unlimited login attempts.
Technical details
A database transaction handling bug in Vikunja's login handler prevents account lockouts from being persisted. When a TOTP validation fails, the application triggers a database rollback that inadvertently undoes the 'StatusAccountLocked' write performed by the failed authentication handler. While an in-memory counter tracks attempts, the actual account status change is never committed to the database. This allows an attacker with a valid password to brute-force the 6-digit TOTP space. The vulnerability is mitigated by per-IP rate limiting, but this can be bypassed by distributed attackers using multiple source IPs. The issue is fixed in version 2.3.0 by using an independent database session for lockout operations.
Affected products
- Vikunja Vikunja <= 2.2.2
Timeline
- 2026-04-09: disclosed
- 2026-04-10: advisory
- 2026-04-10: patched: Fixed in version 2.3.0