# Vikunja CalDAV and feeds BasicAuth brute force bypass

Source: https://junglewise.ai/threats/duplicate-advisory-vikunja-caldav-and-feeds-basicauth-endpoints-have-no-1e0e4a27  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-10-09  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.5 · Published 2026-09-15

Vikunja is a self-hosted task and project management platform. The CalDAV and feeds authentication endpoints lack rate limiting, allowing attackers to perform unlimited password-guessing attacks against user accounts while the main login endpoint is protected. An attacker with network access can compromise password-only accounts by bypassing the application's brute-force protection.

Technologies: [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api), [Vikunja](https://junglewise.ai/threats/technologies/vikunja). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Vikunja](https://junglewise.ai/threats/vendors/vikunja).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.5, published 15 September 2026.

**Which products and versions are affected?** code.vikunja.io/api (Go) <= 2.5.0; Vikunja <= 2.5.0.

**Is there a fix for This vulnerability?** Yes: fixed in 2.6.0. Until then: Apply the pre-auth rate-limit floor to the /dav, /.well-known, and /feeds endpoint groups, or restrict network access to these endpoints to trusted networks pending an upgrade. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a web application.

**Am I affected?** Check whether you run code.vikunja.io/api (Go) or Vikunja at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.6.0

Apply the pre-auth rate-limit floor to the /dav, /.well-known, and /feeds endpoint groups, or restrict network access to these endpoints to trusted networks pending an upgrade.

## Technical details

The /dav, /.well-known, and /feeds endpoints accept BasicAuth with plain account passwords but lack the rate-limiting middleware applied to /api/v1/login. An unauthenticated attacker can send unbounded PROPFIND or GET requests to these endpoints with credential-guessing attempts; each wrong password returns 401, and rate-limiting never engages (bcrypt is the only bottleneck). The vulnerability affects password-only accounts; TOTP-enabled and bot users are protected.

## Affected products

- Vikunja Vikunja <= 2.5.0

## Timeline

- 2026-08-31: disclosed
- 2026-09-15: advisory

## References

- [https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m469-88xx-8rx2](https://github.com/go-vikunja/vikunja/security/advisories/GHSA-m469-88xx-8rx2)

## Related threats

- [Vikunja denial of service via pagination bypass in API v1](https://junglewise.ai/threats/cve-2026-123531-vikunja-from-1-0-0-before-2-7-1-contains-an-uncontrolled)
- [Vikunja missing authentication in TOTP enrollment](https://junglewise.ai/threats/cve-2026-123530-vikunja-before-2-7-1-contains-a-missing-authentication)
- [Vikunja stored CSS injection in rich-text table cells](https://junglewise.ai/threats/cve-2026-123529-vikunja-before-2-7-1-contains-a-stored-css-injection)
- [Vikunja insufficient session expiration in HTTP token middleware](https://junglewise.ai/threats/cve-2026-123528-vikunja-before-2-7-1-contains-an-insufficient-session-expiration)
- [Vikunja API token authorization bypass in v1/v2 collision](https://junglewise.ai/threats/cve-2026-123527-vikunja-from-2-4-0-before-2-7-1-contains-an-authorization-bypass)