Executive brief
Vikunja is an open-source task management and project collaboration platform. A vulnerability allows attackers to bypass the password brute-force protection that normally limits login attempts to 10 per minute. By attacking CalDAV, feeds, and well-known endpoints instead of the regular login page, attackers can make unlimited guesses at user passwords without rate limiting, potentially compromising any password-only accounts on the system.
Technical details
The vulnerability is a failure to apply rate limiting (CWE-307) on CalDAV and feeds BasicAuth endpoints. The /dav, /.well-known, and /feeds routes are registered in pkg/routes/routes.go with only BasicAuth middleware and no rate limiter, while the standard /login endpoint enforces an unconditional 10 requests/minute/IP floor. CalDAV BasicAuth in pkg/routes/caldav/auth.go accepts plain account passwords and falls through to user.CheckUserCredentials, making it suitable for password guessing. Attackers can issue unbounded credential-guessing requests against these endpoints without triggering 429 (too many requests) responses, entirely bypassing the instance's anti-brute-force protection. TOTP-enabled and bot accounts are correctly refused, so only password-only accounts are at risk. The fix is to apply the same pre-auth rate-limit floor to the vulnerable endpoints.
Affected products
- Vikunja Vikunja before 2.6.0
Timeline
- 2026-09-15: disclosed: CVE-2026-91973 published