Vikunja CalDAV and feeds BasicAuth brute force bypass

Severity: high · CVSS 7.5 · Published 2026-09-15

Vikunja is a self-hosted task and project management platform. The CalDAV and feeds authentication endpoints lack rate limiting, allowing attackers to perform unlimited password-guessing attacks against user accounts while the main login endpoint is protected. An attacker with network access can compromise password-only accounts by bypassing the application's brute-force protection.

Technologies: code.vikunja.io/api (Go), Vikunja. Vendors: Go, Vikunja.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 7.5, published 15 September 2026.
Which products and versions are affected?
code.vikunja.io/api (Go) <= 2.5.0; Vikunja <= 2.5.0.
Is there a fix for This vulnerability?
Yes: fixed in 2.6.0. Until then: Apply the pre-auth rate-limit floor to the /dav, /.well-known, and /feeds endpoint groups, or restrict network access to these endpoints to trusted networks pending an upgrade. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a web application.
Am I affected?
Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 2.6.0

Apply the pre-auth rate-limit floor to the /dav, /.well-known, and /feeds endpoint groups, or restrict network access to these endpoints to trusted networks pending an upgrade.

Technical details

The /dav, /.well-known, and /feeds endpoints accept BasicAuth with plain account passwords but lack the rate-limiting middleware applied to /api/v1/login. An unauthenticated attacker can send unbounded PROPFIND or GET requests to these endpoints with credential-guessing attempts; each wrong password returns 401, and rate-limiting never engages (bcrypt is the only bottleneck). The vulnerability affects password-only accounts; TOTP-enabled and bot users are protected.

Affected products

  • Vikunja Vikunja <= 2.5.0

Timeline

  • 2026-08-31: disclosed
  • 2026-09-15: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.