Executive brief
Vikunja is a task and project management application. Before version 2.6.0, the application exposed the TOTP (two-factor authentication) shared secret through unprotected API endpoints, allowing attackers with a valid access token to read the secret, add it to their own authenticator app, and generate valid codes indefinitely. This enables complete bypass of two-factor authentication and account takeover, especially when combined with a compromised password.
Technical details
The vulnerability is a credential exposure (CWE-522) affecting the TOTP enrollment flow in Vikunja. The GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints return the raw TOTP shared secret and provisioning URL to any client holding a valid access token, without requiring re-authentication. An attacker with a stolen, leaked, or session-hijacked access token can extract the base32 secret and import it into a third-party authenticator application to generate valid six-digit codes indefinitely. The vulnerability is inconsistent with the security model of the disable endpoint (POST /api/v1/user/settings/totp/disable), which correctly checks the user's password before permitting TOTP removal. No logging or user notification occurs when the secret is read. The fix, implemented in version 2.6.0, prevents the secret field from being returned once TOTP is enabled.
Affected products
- Vikunja Vikunja before 2.6.0
Timeline
- 2026-08-31: disclosed: GitHub Security Advisory (GHSA-88f6-4rjv-x774) published
- 2026-09-15: advisory: CVE-2026-91982 published and indexed by NVD
- 2026-09-15: patched: Fix available in version 2.6.0