Is CVE-2026-91973 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91973 being exploited in the wild.

How severe is CVE-2026-91973?

High severity, with a CVSS score of 7.5, published 15 September 2026.

Which products and versions are affected?

code.vikunja.io/api (Go) <= 2.5.0, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.6.0; Vikunja before 2.6.0.

Is there a fix for CVE-2026-91973?

Yes. code.vikunja.io/api (Go): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-91973 attacked?

It is attacked over the network.

Am I affected by CVE-2026-91973?

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91973: Vikunja authentication bypass in CalDAV BasicAuth endpoints

Q: Is there a fix for CVE-2026-91973?

Yes. code.vikunja.io/api (Go): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-91973 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-91973?

Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91973 · Severity: high · CVSS 7.5 · Published 2026-09-15

Vikunja is an open-source task management and project collaboration platform. A vulnerability allows attackers to bypass the password brute-force protection that normally limits login attempts to 10 per minute. By attacking CalDAV, feeds, and well-known endpoints instead of the regular login page, attackers can make unlimited guesses at user passwords without rate limiting, potentially compromising any password-only accounts on the system.

Technologies: code.vikunja.io/api (Go), Vikunja. Vendors: Go, Vikunja.

Quick answers

Is CVE-2026-91973 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91973 being exploited in the wild.
How severe is CVE-2026-91973?: High severity, with a CVSS score of 7.5, published 15 September 2026.
Which products and versions are affected?: code.vikunja.io/api (Go) <= 2.5.0, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.6.0; Vikunja before 2.6.0.
Is there a fix for CVE-2026-91973?: Yes. code.vikunja.io/api (Go): upgrade to 2.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91973 attacked?: It is attacked over the network.
Am I affected by CVE-2026-91973?: Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code.vikunja.io/api (Go): upgrade to 2.6.0 or later
```
go get code.vikunja.io/api@v2.6.0
```

Technical details

The vulnerability is a failure to apply rate limiting (CWE-307) on CalDAV and feeds BasicAuth endpoints. The /dav, /.well-known, and /feeds routes are registered in pkg/routes/routes.go with only BasicAuth middleware and no rate limiter, while the standard /login endpoint enforces an unconditional 10 requests/minute/IP floor. CalDAV BasicAuth in pkg/routes/caldav/auth.go accepts plain account passwords and falls through to user.CheckUserCredentials, making it suitable for password guessing. Attackers can issue unbounded credential-guessing requests against these endpoints without triggering 429 (too many requests) responses, entirely bypassing the instance's anti-brute-force protection. TOTP-enabled and bot accounts are correctly refused, so only password-only accounts are at risk. The fix is to apply the same pre-auth rate-limit floor to the vulnerable endpoints.

Affected products

Vikunja Vikunja before 2.6.0

Identifiers

CVE-2026-91973
GHSA-m469-88xx-8rx2
GO-2026-6737

Timeline

2026-09-15: disclosed: CVE-2026-91973 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.