Is CVE-2026-62376 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62376 being exploited in the wild.

How severe is CVE-2026-62376?

High severity, with a CVSS score of 8.1, published 9 October 2026.

Which products and versions are affected?

code.vikunja.io/api (Go) <= 2.3.0, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.4.0; Vikunja <UNKNOWN.

How is CVE-2026-62376 attacked?

It is attacked over the network.

Am I affected by CVE-2026-62376?

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62376: Vikunja plaintext storage of authentication tokens in database

Q: Is there a fix for CVE-2026-62376?

Yes. code.vikunja.io/api (Go): upgrade to 2.4.0 or later. Until then: Apply the fix to replace genToken with generateHashedToken for the three affected token types and update token lookup to use bcrypt comparison rather than plaintext SQL equality, mirroring the existing CalDAV token implementation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-62376 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-62376?

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62376 · Severity: high · CVSS 8.1 · Published 2026-10-09

Vikunja, an open-source task management and collaboration platform, stores password-reset, email-confirmation, and account-deletion tokens in plaintext in its database. An attacker who gains read access to the database through a backup leak, misconfiguration, or SQL injection can immediately use these tokens to take over any user account without knowing the password, including administrator accounts.

Technologies: code.vikunja.io/api (Go), Vikunja. Vendors: Go, Vikunja.

Quick answers

Is CVE-2026-62376 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62376 being exploited in the wild.
How severe is CVE-2026-62376?: High severity, with a CVSS score of 8.1, published 9 October 2026.
Which products and versions are affected?: code.vikunja.io/api (Go) <= 2.3.0, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.4.0; Vikunja <UNKNOWN.
Is there a fix for CVE-2026-62376?: Yes. code.vikunja.io/api (Go): upgrade to 2.4.0 or later. Until then: Apply the fix to replace genToken with generateHashedToken for the three affected token types and update token lookup to use bcrypt comparison rather than plaintext SQL equality, mirroring the existing CalDAV token implementation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62376 attacked?: It is attacked over the network.
Am I affected by CVE-2026-62376?: Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code.vikunja.io/api (Go): upgrade to 2.4.0 or later
```
go get code.vikunja.io/api@v2.4.0
```

Apply the fix to replace genToken with generateHashedToken for the three affected token types and update token lookup to use bcrypt comparison rather than plaintext SQL equality, mirroring the existing CalDAV token implementation.

Technical details

The vulnerability exists in genToken() which stores random token strings without hashing in the user_tokens table, and lookup uses plaintext SQL equality rather than cryptographic comparison. Affected token types are TokenPasswordReset, TokenEmailConfirm, and TokenAccountDeletion; CalDAV tokens correctly use bcrypt hashing. An attacker with database read access can dump all pending tokens and immediately redeem them via the password-reset API endpoint within the 24-hour token lifetime.

Affected products

Vikunja Vikunja <UNKNOWN

Identifiers

CVE-2026-62376
GHSA-r6w9-259g-gwrv
GO-2026-6748

Timeline

2026-10-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.